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channels. For the insiders, there are reminders of their duty to 
remain pious Muslims, serve the caliphate, and avoid being lazy. 
There was the occasional instruction to share links to like-minded 
cult members. 


The Media Pitch 
Islamic State supporters online have exceeded tens of thousands. 
However, a great number of them only watch video releases and 


follow the news. 


To those, I send this message: Supporting brother, you are a part of the 
Islamic State media on the Internet; don’t be a liability by just 
watching videos and following only, but learn how to upload, share, 
transcript, translate, program and work towards having an impact on 
the ongoing war against the disbelieving Crusaders. 

Just as a society, Islamic State supporters include very diverse 
people with different skills and abilities; use what you now to do best 
to support the Islamic State. If you don’t, learn how to download/ 
upload releases, get the know-how from an efficient supporter. 

Ask yourself, what have you done to support the Islamic [State]? Are 
you here to effectively support the Khilafah or to spend your free time? 
Supporting the Islamic State is by work, not by sitting watching idly. 
Leave the laziness of excuses and ask yourself what can you do to 
support the Mujahideen who defend the honor of the Muslims, facing 
the nations of Kufr and disbelief, giving their blood in battles in the 
east and the west? 

Stand up, dear brother, and learn new skills, this is an obligation 
upon you now that all the nations of Kufr have stood together to face 
the Islamic State—may Allah give it glory—and be a thorn in the 
throats of the disbelievers. Share the truth about the Islamic State to 
the Muslims. How many Muslims have been guided and saw the reality 
of this war thanks to Allah then to a video release, a picture report, 
and article or just a tweet from an Islamic State supporter? 

It’s our duty dear brother, put your trust in Allah, take the necessary 
online precautions and support the Mujahideen with everything you 
can. 

Translated from Arabic by Maghrebi Witness —MW 


Like many messages from ISIS, the aim of this message was to be 
spread widely. 


The Propagation Channels 
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Figure 66: Khilafah News banner. (Source: TAPSTRD 


Khilafah News 

Fed by official headlines from around the caliphate, Khilafah 
Internet News shares the daily lists of attacks, excerpts from 
speeches by leaders, or other headlines created by the actions of 
ISIS leaders. Khilafah news was often found on posting sites like 
JustPastelt and on Telegram. 
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Figure 67: Telegram advertisement of Nashir’s new Portuguese channel from 
ISIS. (SOURCE: TAPSTRI) 


NASHIR Telegram Channel 

This channel posts photo slide shows, official ISIS announcements, 
and link clusters to the latest official ISIS videos. Unlike several 
other channels, it does not engage in propagating links for 
unofficial sources or the various echo chamber videos. It will also 
publish the links to the latest official ISIS print media like an-Naba, 
Dabiq, or other releases. 

When the channel announced it would start broadcasting in 
Portuguese, there were analysts who took this to mean that ISIS had 
established a foothold in Brazil. The concerns were largely tied to 
security concerns around the Summer 2016 games in Rio. The 
games were completely without incident. 


ALBAYAN RADIO 


gull Laylpll le YgAall gll acl) gu claiwyl! 


bayanradio.xyz 


Figure 68: Al-Bayan Telegram advertisement from ISIS. (Source: TAPSTRI) 


Al-Bayan Radio 
Daily dispatches from events in the ISIS region and with occasional 


announcements from across the world. Releases are featured as 
mp3s along with .doc and .pdf releases of the headlines in both 
Arabic and English. The outlet has also been featured in short-lived 
website form as both stand-alone domain and as a wordpress.com 


page. 


aki 


AMAQ AGENCY 


FOLLOW THE LATEST 


WITH THE NEW AMAQ AGENCY APP 


Figure 69: AMAQ Agency Telegram advertisement from ISIS. (Source: 
TAPSTRI) 


Amaq News Agency 

Amaq News Agency is the source that was almost synonymous with 
ISIS claims of responsibility even though it is not listed by ISIS as an 
official agency. Though never listed in the official centers under 
ISIS, it acts more in conjunction with ISIS than any other satellite 
organization. Though little is known about its staff or hierarchy, it 
was revealed after his death that ISIS minister of information and 
head of al-Furqan media, Wa’el Adel Hasan Salman al-Fayad, was a 
board member of Amaq. Despite this, al-Furqan’s video The 
Structure of the Khilafah did not list Amaq despite listing al-Bayan 
(radio), an-Naba (newsletter), Ajnad (nasheeds, sermons), Al-Hayat 
(non-Arabic publications), and Maktabat al-Himmah (print 
publications). 

The group films and photographs events in the same manner as 
normal news agencies around the world, but with ISIS pointing the 
finger at the Assad regime, the coalition forces, and the various 
militias who are fighting ISIS in Syria and Iraq. 

Amaq News Agency ran several Telegram channels in English and 
Arabic. They developed their own news feed app for Android 
phones. 


OFFICIAL DISTRIBUTION 


In the early days of jihadist media, the communication and 
propaganda was disseminated via cassettes, VHS, or Hi8 tapes. 
Eventually that gave way to digital media like CDs, DVDs, jump 
drives, and smart cards. AQI Spokesperson for Zarqawi, Abu 
Maysara al-Iraqi, used YouSendIt to send files after running into 
perpetual issues at the time with file hosting on free pages like 
Yahoo.10 

The materials are introduced to the web via uploads to any 
number of these dead drop sites, or sites intended to dump data 
anonymously, and now also via Telegram downloads. Once on the 
web, the messages on Twitter and Telegram often post links to a 
dozen or so sites that are file sharing-related and the “official” 
version uploaded to Archive.org. For a while, Archive.org was 
rather slow to take the clips down, but by mid-2016 they were 
becoming very effective in responding with file deletion of audio- 
video material from ISIS sources. In some cases, videos would be 
posted and within two hours or less it was a dead link at 
Archive.org and/or YouTube. By then, Twitter and Telegram 
messages that contained these links would be useless. 

But there are occasional stand-alone pro-ISIS media archive sites 
that migrate frequently around the web. These outlets keep up with 
the video releases. Though they are becoming less common, they 
are still published occasionally on Telegram channels. By 2016, the 
most common means of finding ISIS videos would be Telegram. All 
day long there are download links published and direct links for 
getting the file via channels on the social media platform. 


The Modern Day “Digital” Dead-Drop 

In literature and life, spies used to have rocks, boxes, and other 
strange locations to do “dead-drops,”an old intelligence term for a 
place where items such as a film minicassette and money could be 
left without the agent waiting around to be discovered. But for the 
modern-day terrorist, Internet pasting pages are the prime location 
used to send files, save files, or otherwise share data with 
conspirators without hassle—digital dead-drops. The terrorists 
before YouTube had to come up with a way to share videos. Abu 
Maysara al-Iraqi was one of the first to simply go to YouSendIt to 
share files with AQI supporters.11 


Some of the sites used by ISIS in the first few years include 
JustPaste.it, Google Drives, YouTube, Cloud.mail.ru, 
Dailymotion.com, Archive.org, My.mail.ru, Sendvid.com, 
Userscloud.com, and Samaup.com. 

Using these sites, the followers fill up repeaters of the original 
file, making it harder to eliminate the files from the web. In some 
cases, ISIS users have coordinated all the ISIS videos into files with 
the material organized and categorized by wilayat and release 
numbers. Other sites like TimesOfIS.wordpress.com maintained a 
running chronology that was reliably updated for months until it 
was deleted by Wordpress in May 2016. In other cases, sites like 
ISdarat variations on Wordpress kept track of affiliated releases 
from al-Battar, al-Samoud, and al-Waad in addition to Amaq and 
official ISIS media channels. 


Distribution on Telegram 
In Telegram, you may run across channels that are available to read 
or “join” without hindrance, but most of the important channels are 
set to privacy after an initial period of announcement. Posts flow all 
day with links to other ISIS forums, postings that you have to watch 
continuously or miss your way in for another day. If you’re trying to 
follow Amaq News Agency, for instance, your access to the channel 
can last anywhere from a few minutes to a couple of hours before 
you get “Error-The Invite link is invalid. Technical details here.” 

The channels of ISIS and AQ material on Telegram have a range 
of subjects that break down into General news about the caliphate 
(internal and external), Publications (the latest video, slide show, 
pamphlet, or magazine), Rebroadcasters (users who only recycle 
other’s postings), Graphics or How To Channels, Operations 
channels (Online Da’wah Operations, CCA), and of course plenty of 
cult-level obsession with the passages and interpretations of the 
Quran. There’s even a snarky channel mentioned earlier called “Did 
you know?” that loves to point out bits from Islamic history to show 
how uninformed or ignorant the disbelievers can be. “Did you know 
that Jack Sparrow is really Yusuf Reis?” one says as it seeks to show 
how Hollywood and American pop culture doesn’t, namely, that 
these figures came from Islamic culture. 

Another channel, al-Nusra al-Shameya, spent months posting 
how-to graphic instructions so you can learn how to cut out horses, 
fighters, and other figures from the video stream and make your 


own shiny ISIS video graphic. The tools would be easy-to-use 
graphic apps, which are often included. 


Rely on the News Echo Chamber 

ISIS was well aware of how to use the news cycles as their 
predecessors had before them. Well-timed manipulation of video 
releases, audio releases, magazines, and other materials keep 
journalists, analysts, and counterterrorist analysts waiting for the 
next bit of information. This game continued under ISIS. 

When Kim Sun-il was killed in June 2002, Jama’at al-Tawid sent 
a video tape of his execution to al-Jazeera, which injected the story 
into the news cycle. Earned media was free media because the 
shock value of ISIS media content was effective in getting the 
attention of and a free echo from news outlets, officials, and the 
chattering class. Point made? 

For instance, after the execution of Bulgarian citizen Georgi 
Lazov, Zarqawi’s group, Tawhid wal Jihad, posted a statement, 
“Await for a video with the execution of the Bulgarian unbeliever” 
and a single photograph of a fighter holding a severed head. 12 

In June 2016, a release from al-Furqan had counterterror analysts 
locked to their Telegram and Twitter feeds as they waited to hear 
an audio clip from Abu Muhamad al-Adnani that called for attacks 
during Ramadan. The guessing game went on for hours to the point 
where ISIS followers in Telegram and Twitter channels were 
laughing at the analysts with eager anticipation. When the audio 
finally came down and the watching and waiting had yielded a 
disappointing result—it wasn’t a message from al-Baghdadi. Many 
had believed it would be because it was supposed to come via al- 
Furqan. 


THE BATTLE OF THE #HASHTAGS 


The caliphate followers are strong proponents of the use of hashtags 
and extensively use various tags to promote their latest campaigns. 
The choice of tag depends largely on the aim of either promoting a 
message or mocking (trolling) a message. Many times when looking 
for a new video release you could go to Twitter and type in 
something like #alfurqan, or if you could read Arabic you could 
follow the hashtags associated with ISIS channels more directly by 


following tags that were very topical or referred to regional clashes 
in Syria, Iraq, or Yemen. 

The primary tags associated with ISIS have been #IslamicState 
and #ISIS. There are times where the tag was aimed at followers 
like #WeAllGiveBayahToKhilafah from late August 2015. 

Sometimes the tag was intended as psychological warfare, like 
the hashtag that was aimed at the United States during Steven 
Sotloff’s captivity. In one example, there was a picture made with 
President Obama superimposed over Jihadi John with the phrase, 
“Why Would I Care about Him,” and the hashtag 
#StevensHeadInObamasHands. 13 


Hijacking Trending Tags 

As terror tragedies associated with ISIS hit the news, its followers 
began to flood posts about reactions throughout the world. Tags 
like #prayfornice or #orlandoshooting became ripe for trolling by 
ISIS fanboys to the irritation of those still in shock over the attacks. 
It didn’t take long after the attack in Nice, France, for ISIS Telegram 
channels to begin encouraging mocking (trolling) hashtags 
reflecting the tragedy. While trolling, their members could not only 
excite the hatred against the group, but discern where they had 
sympathy or potential recruits. 

The group also often attacks random targets in order to get 
attention, instill fear, or both. In January 2016, ISIS fanboys 
attempted to hijack #JustinBieber with a banner for an execution 
video. 

One group that regularly invades hashtags is the Online Dawah 
campaign; it is the almost official troll brigade online. With a 
Telegram channel in hand, they set their daily aims on pages with 
comment sections in order to harass participants, Muslim and 
unbeliever alike. 


Made Ya Look 

ISIS took their method of getting the world’s attention up a notch in 
the late spring of 2016. On a Saturday morning in May of 2016, 
notification went out that there was a new al-Furqan release coming 
soon. With a technique as simple as advertising an upcoming 
release, ISIS via al-Furqan demonstrated that it was able to capture 
the attention of the analyst and law enforcement world in a long 
waiting game played out on that Saturday in May. First, al-Furqan 


released a “coming soon” banner then followed it in multiple 
languages across multiple platforms and channels including 
Telegram and Twitter. Analysts were guessing at what the content 
would be for hours. Was it a claim of responsibility for the missing 
Egypt Airbus? Was it going to be al-Baghdadi? 


THAT THEY 


LIVE BY PROOF 


Coming Soon, In Sha Allah... ai 


Figure 70: That They Live by Proof banner. (Source: TAPSTRI) 


The hashtag #alfurqan started trending—being widely picked up on 
by Internet users—but by late morning found that what had been so 
keenly anticipated was merely an audio message from al-Adnani 
called “That They Live by Proof” calling for ISIS followers to launch 
attacks wherever they happened to be in the name of ISIS. There 
had been great hope that the release would be a claim of 
responsibility for the downing of EgyptAir MS804. A month later, 
the same hashtag would be used to advertise al-Furqan’s video The 
Structure of the Khilafah, a presentation aimed at demonstrating that 
it was a vibrant state. 

But the battle wasn’t one-sided, as the hashtags #DefeatingDaesh 
and others were in play. Counterefforts were often given hashtags 
including #khawarij, a term the terror group particularly did not 
like. 


#AllEyesOnISIS 

Launched by Twitter handle @Ansaar999, this hashtag was dubbed 
the source of an ISIS “Twitter Storm” in late June 2014 as ISIS 
swept across Iraq and Syria, declaring the founding of a caliphate at 
the end of the same month. Seemingly from all over the world, 
followers were posting pictures of their locations and stating they 
were supporting the caliphate. Yet many of these photos had been 
previously published months earlier and were unrelated to the 
upcoming “Twitter Storm.” One from @ahmetmatar11 (featuring a 


still of al-Bilawi) had a picture of pink cupcakes topped with ISIS 
flags and a flag in the background with “Support from South Africa” 
in the tweet. 

In a way, #hashtags are very representative of what makes 
groups like #ISIS hard to defeat. You can eliminate the @users, but 
the hashtag theme (#idea) has taken shape in a manner that was 
harder to knock down. 


THE SHIFTING LANDSCAPE 


As the technology shifts, we can expect to see the methods of 
creation, dissemination, and the medium of delivery change. We 
can also expect to see a change in the emphasis as conditions on the 
ground for ISIS change. At the time of this writing news just broke 
from Syria of the death of Abu Muhammad al-Adnani, who was 
highly involved in the media campaigns. 

Additionally, there are few notable anti-ISIS media campaigns 
undertaken to challenge the propaganda coming from the voices of 
ISIS, official or unofficial alike. The lack of substantial pushback to 
their message emboldens their voice. The only notable anti-ISIS 
media, ironically, come from al-Qaeda and AQ affiliates like Jabhat 
Al-Nusra, al-Qaeda in the Arabian Peninsula, and al-Qaeda in the 
Maghreb. There are Muftis and clerics who have challenged ISIS, 
but there have been no notable campaigns to get their message out 
to the masses in a manner that compares to the propaganda 
onslaught of ISIS. 


Chapter 10 


ISIS Digital and Strategic 
Communications Tool Kit 


There are two primary purposes for which cyber jihadists use digital 
tool kits: Communications and Security. 


COMMUNICATIONS 


Key to ISIS activities is their ability to broadcast across the 
organization and out to the world. With use of smartphone apps, 
social media sites, and free file hosting, the organization exploited 
most of the commonly available online communication tools. 


End-to-End Communication 

Terrorist organizations have an urgent need for apps that enable 
them to communicate. In order to recruit, conduct operations, or 
inform the followers of the latest events or expectations, these 
groups need the technical means to do so without all the trappings 
found in account setups, cell phone accounts, or email 
communications. The prime pick of apps used for end-to-end 
communications by summer of 2016 were Telegram, WhatsApp, 
Surespot, and Signal. Communication tools are picked based on the 
belief that they are secure end-to-end communications. When news 
hits the mainstream technical magazines of a breach or 
vulnerability, ISIS and other groups grow suspicious and often 
migrate to a new platform for communications. 


Propagation 

The second need was to propagate the message of the caliphate to 
targeted audiences. This might include their current or potential 
cult members or the broader international audience. Entries on 
Telegram channels may contain attached downloads or, just like 
JustPaste.it posts, offer direct links to the latest videos on 
Archive.org, Google Drives, and other file sharing sites. This gives 
supporters alternative ways to share the ISIS materials widely in 
order to guarantee access. They must accomplish this in the face of 
a constant effort to take down these materials by both government 
efforts and grassroots activist intervention. 

Apps like Amaq or al-Bayan radio make the latest news headlines 
from ISIS available. Need to know what the latest da’wah campaign 
is doing? Or need to know the latest news out of Syria? There’s an 
app for that. Communication between operatives or from ISIS or AQ 
central to followers requires using a great many of the tools in the 
cyber jihadist tool kit. 

Examples: Telegram was both an end-to-end messenger and an 
online location on which one could read the latest discussion, news, 
and announcements from ISIS, AQ, and other organizations. Due to 
the addition of channels, Telegram has in many ways replaced the 
jihadist website of years gone by. As the takedown efforts of Twitter 
started to have their effect, users were migrating to Telegram to get 
the latest information. For some leaders in the media department, 
Twitter is still recommended as an effective means to propagate the 
ISIS message on the Surface Web. 


Community 
A major component of web usage by international terrorists was the 
need to form bonds. Ironically, the need to avoid detection by legal 
authorities runs into the need of the terrorist community to identify 
and express itself in ways no different from the ones that 
subcultures around the world employ to express themselves. For 
instance, the sharing of pro-ISIS humor that may upset Americans 
or Europeans quickly elicits unifying laughter from followers on 
Twitter or Telegram. This “humor” has included superimposing 
leaders’ heads over a doomed captive facing beheading or one 
particularly upsetting graphic in which injured US soldiers were 
mocked by ISIS followers on a Telegram channel. 

There was a clear need for community in the communications of 


ISIS. The us-versus-them language was rampant, and the target-of- 
the-day postings are meant to unify a powerful and targeted 
resentment. It also serves to further unify the ISIS followers who 
enjoy being in on the “jihadi-cool” found in much of the chatter on 
Telegram and Twitter, as true believers in the ISIS cause enjoy the 
same punchlines at the expense of the disbelievers or the apostates. 
They share in the glee of the fall of their enemies and the worship 
of their dead fighters. Whether Telegram or Twitter, the app tools 
help to foster a sense of community. 


Commentary 

Apps are used to participate in the many political discussions of the 
world, enlivened by comments with a slant only ISIS followers 
could provide. This includes discussions on breaking news events— 
the attempted coup in Turkey, downed airliners, or domestic events 
in countries that can be spun into validation of the caliphate’s goals. 
It is also where the followers of these groups turn to for the latest 
message from ISIS or AQ officials or to enjoy the irreverent postings 
against the disbelieving kufar. ISIS keeps up with American and 
European news and often comments on the headlines along with 
graphics posted in Telegram channels taken from cell-phone screen 
shots. 


THE NEED FOR SECURITY 


The other imperative for using the tools available was to provide 
security. While almost all the tools have some application to 
maintaining security, there are specific uses for certain tools, in 
particular the ones used for encrypting messages or ones used for 
eluding detection, leaving no footprint, and destroying materials to 
prevent the opposition from obtaining them. 

The level of support for an app was dictated by the perceived 
security of the tools being used to conduct these activities. When 
security was perceived to be an issue for a forum online or for an 
app on a phone, ISIS/AQ media warnings follow and migrations to 
other tech options occur. It was very common to have tech tools 
discarded quickly upon the mere speculation that intel agencies had 
a hand in making them. 

IsIS-related tech groups and channels keep up with conventional 


tech columns and forums, specialists’ Twitter accounts, and news 
flashes that let them know what is currently happening in the 
technology realm and subsequently advise the ISIS faithful to follow 
new recommendations. In some cases, posts made on Twitter by 
recognized tech experts wind up as Telegram posts within minutes, 
with news on encryption, net security, hacking, or other security 
matters. 

Terrorists also pay attention to what happens to their own 
followers after an operation. Trend Micro, a cyber security firm, 
noted a decline in the usage of Facebook’s communications app, 
WhatsApp, after arrests led to investigations of the usage of the web 
tool by terrorist suspects.1 

Potential targets of investigation are very aware of the use of 
metadata to capture them or their colleagues. In one example, 
noted in the Boston beheading plot of June 2015, David Wright was 
alleged by prosecutors to have been told by Usama Rahim to 
destroy the phone and wipe the laptop clean by resetting and 
clearing the hard drive.2 


THE ISIS-APPROVED MOBILE PHONES 


“(duh...Please don’t attempt to make hijra if your parents 
confiscated your phone),” reads the Hijrah guide produced by ISIS. 
The “Hijrah to the Islamic State” publication purportedly put out by 
ISIS states: “Also remember to never use iPhones, Androids are 
securer.”3 It also says “Buy a SIM card at the airport, but don’t buy 
any SIM card, buy a Turkcell SIM card.” After you’ve done this, of 
course you have to call the “Office of Borders of Dawlah,” the guide 
continues. 

It’s clear that ISIS and AQ use a range of tools based on 
availability. There are preferences based on user recommendations 
and security considerations. Then there are phones actually 
confiscated. The largest group of users are on Android phones, and 
some are on iPhone. The preferences of phone are limited by 
availability, so it was not possible for ISIS to maintain a steady 
operation in terms of equipment. In the Paris attacks of November 
2015, a Samsung smartphone was used.4 Weeks later in San 
Bernardino, Saed Rizwan Farouk was using an iPhone 5c provided 
by the county agency he worked for when he and his wife attacked 


coworkers on December 2, 2015. The phone was under a password- 
protected lock, and after strenuous attempts by the US government 
to make Apple Inc. provide access, the FBI announced on March 28, 
2016, that it had successfully unlocked the phone. 

Phones can be used not only for texting on apps, but for sending 
voice messages, a common way followers seek to avoid detection, 
since there will be no metadata to read from the audio file. One 
mother, Karolina Dam, even had a friend of her son’s play back 
messages from him seeking to recruit him into ISIS. Her son, Lukas, 
died in Syria, and she kept in touch with him via the messaging app 
Viber until he died in Syria.5 


Chapter 11 


All Is Great in the Caliphate 


ISIS has manipulated much of the Western news media into 
believing it speaks for Islam. Their videos and photos portray them 
as being the judge, jury, and executioners of the Muslim faith. We 
will show how this image is false and when propagated by the West 
to attack ISIS it actually achieves ISIS’s goals for them. What does 
“achieves ISIS’s goals for them” mean? When ISIS makes the 
decision about whether you are a believer or unbeliever, but also 
whether you are a proper believer, a video is made, crafted to your 
belief system. With thousands of hours spent delivering this 
message, it’s clear that the real targets of ISIS aggression 
recruitment are other Muslims, and in their campaign of 
recruitment, the Western news media was their best enabler. 

ISIS videos have characteristics that are quite unlike media 
previously produced and disseminated by groups in the jihadist 
world. It is from the concept of the caliphate itself that ISIS draws 
its rhetorical strength, and it is the caliphate that ISIS portrays as 
expanding and resilient. Through this message, all campaigns, all 
festivals, all bay’at ceremonies, and messages to others are framed. 
The first message level was sent to other Muslims, as ISIS claims to 
fulfill a prophecy from a dim, distant past for the benefit of Muslims 
today. The graphic content of many ISIS videos may mask the 
central narrative message—ISIS speaks to the pure Muslim who has 
found the path of righteousness by accepting the ISIS media’s 
version of Islam. 

There are two primary audiences for ISIS videos, Us and Them. 
But in the “Them” category you have many subcategories. The ISIS 


narrative always paints ISIS as the noble victim who has become 
the noble victor. To justify its campaigns and attacks, ISIS cites 
grievances accumulated over centuries. The expression of historical 
grievance takes up much of the first part of all of their videos. 
Contrary to the logical assumption that the next and most intense 
focus would be on the kufar or disbeliever, the rage of ISIS is 
initially reserved for people it labels apostates or spies. 

In order to justify its attacks on other Muslims, ISIS finds endless 
numbers of people who have committed a crime against the state. 
The most heinous crime would be allowing the anti-ISIS forces to 
destroy the caliphate. Such arch criminals include Iraqi and Syrian 
nationals who are fighting to defeat ISIS within their borders. This 
includes Turks who are obstructing the flow of fighters through 
Gaziantep and other border towns. It includes Egyptian police and 
military who have been fighting in the Sinai region for years and 
suffering many casualties. 

Thus the first objective of ISIS’s struggle to create a perfect world 
for Muslims involves killing a great many Muslims. The massacres 
are rarely covered in American or European news media—or even if 
they are, the coverage is minimal and soon forgotten. For example, 
compare the amount of coverage given the attacks in Brussels or 
Nice to the coverage of just one Baghdad bombing in July 2016 that 
killed over 300 people. The coverage of American and European 
attacks was massive, with follow-up stories continuing over days 
and weeks after the incidents that included the names and stories of 
those who lived and those who died, the background of the killers, 
and much more. But how many people in the Western countries 
know the names and stories of those killed in Baghdad? 


REMOVING THE GRAY ZONE IN ISLAM 


It is accepted that a Muslim can essentially excommunicate another 
Muslim, or resort to Takfir, the act of declaring a Muslim a non- 
believer or kufar. It was just one of the prevailing themes in the 
videos and other media created by the ISIS Media Machine. 
Repeatedly the videos, image shows, and pamphlets show a 
dramatic battle of “good” vs. “evil” in the starkest terms, and the 
ISIS lens depicts the enemy in very two-dimensional terms, 
reserving the harshest condemnation for disbelievers and apostates. 


There are no nuanced judgments, no gray areas—it is all black 
versus white. 

The ISIS publication Dabiq, edition 1, page 9, gave us “breaking 
news”: “The World Has Divided into Two Camps,” and those two 
camps are the “camp of Islam and faith” and “the camp of the kufr 
(disbelief) and hypocrisy-The camp of the Muslims and the 
mujahidin everywhere, and camp of the Jews, the crusaders, their 
allies, and with them the rest of the nations and religions of the 
kufr, all being led by America and Russia, and being mobilized by 
the Jews.” 

A page later, the ISIS publication says, “Muslims everywhere, 
whoever is capable of performing hijrah to the Islamic State, then 
let him do so, because hijrah to the land of Islam is obligatory.” 
Then they continue with a “special call” to the Islamic scholars and 
judges, military, and administrative experts to perform hijrah as 
part of their religious obligation. 

As for cases in which hijrah may not be possible, ISIS encourages 
engaging in murdering either disbelievers or apostates. 


“THE GooD MUSLIMS”—THE JIHADI LIVING AND 


DEAD 


Key to the plan of the cult of death, ISIS divides the Muslim 
world into good Muslims and bad Muslims on a regular basis. They 
believe that they are the sole arbiters of who is a good Muslim and 
who is a bad Muslim. By using this division, ISIS pits brother 
against brother, son against father. They use divisions to drive their 
followers to kill anyone who deviates from the ISIS-provided 
doctrine. 


The Soldiers of the Caliphate 

If there was one unifying theme in the media campaign, it was that 
the mujahideen or holy fighter is fighting the ultimate battle of 
good vs. evil. It follows that the video and photo presentations 
released are then used as repeated examples of the Good in the 
form of the holy fighter vs. the Evil apostates, dictators, spies, and, 
of course, the kufar. Much of the running time in all types of ISIS 
videos is devoted to this unyielding battle of good against evil. Only 
those living in the ISIS world see themselves as the pious ones 


blessed by the will of Allah and standing against Shaytan. 

The second theme in these releases was that punishing the 
iniquities of the khilafah, currently thought to infest Syria and Iraq 
with footholds in Libya, Egypt, Yemen, and Afghanistan, united ISIS 
fighters in a nation state. The objective of this blanket 
condemnation was to compel the Muslim faithful everywhere to 
support the caliphate against all aggression. In July 2016, al-Furqan 
released a video called The Structure of the Khilafah, and though it 
was filled with hierarchical information about the ISIS structure, its 
main purpose was to demonstrate to its followers that it was 
vibrant, statelike, taking care of its citizens, all thanks to the efforts 
of ISIS. The video was released just after the fall of Fallujah and the 
subsequent campaign to take Mosul. 

In ISIS media, the fighters are “Defenders of the Religion,” as the 
title of a video from Wilayat al-Furat indicates. This is a repeated 
refrain in ISIS propaganda designed to persuade young men to 
become pious fighters for al-Baghdadi. 
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Figure 71: A fighter saddles up to be a human bomb in this heavily plated 
vehicle. (Source: TAPSTRI) 


Dabiq cites the initial example of Afghanistan, then Kurdistan, for 
the launch of Abu Musab al-Zarqawi’s Jama’atut-Tawhidi wal-Jihad, 
the precursor for al-Qaeda in Iraq, and also singles out “lands with 
conditions that support jihad”—Yemen, Mali, Somalia, The Sinai, 
Waziristan, Libya, Chechnya, Nigeria, Algeria, Indonesia, and the 
Philippines. To emphasize the absolutism of us vs. them, ISIS 


condemns deadly attacks on Sunni women and children by enemies 
in the Syrian or Iranian regimes, seen as the puppets of the 
disbelievers. All of this self-justifying and twisted version of religion 
opens the door to the individual and mass executions captured in 
the unspeakable videos produced by ISIS. 


An Unhealthy Worship of the Dead 

One of the grand hypocrisies committed by ISIS was their endless 
idol worship of attackers as “martyrs” or how they accord fighters 
adulation and celebrity. Not only are images of terrorists like Abu 
Usamah al-Maghribi featured in ISIS media, but those images are 
also posted by followers on social media sites like Twitter, 
Telegram, and Facebook. This hero worship attracts followers who 
ultimately choose to fill the role of an Istishadi, a suicide bomber. 
According to ISIS media, a man can take pride in the prospect of 
being killed fighting for the caliphate. This also influences the 
propaganda aimed at women as they are groomed to become 
martyrs’ wives and give birth to another generation of fighters for 
the caliphate. 


Figure 72: ISIS presents its dead fighter as smiling in Halab photo set. (Source: 
TAPSTRD 


At the heart of all ISIS propaganda is the worship of the dead 
fighter who met God while dying for the religion. In video segments 
featuring foreign fighters explaining why they went to Syria to fight 
for ISIS, it becomes clear that the story of the holy warrior inspired 


them to leave home and die. Of course, some who came to Syria to 
be holy warriors or suicide bombers find themselves digging 
latrines or performing other menial tasks. Martyrdom postponed. 

The macho projection of the warrior was presented as the role of 
the “good Muslim,” and much of this aim was reflected in the titles 
of videos like Resolve of the Brave (al-Anbar) or Knights of Victory 
(al-Fallujah). Dead fighters sometimes become the latest avatar on 
social media. One example is followers’ veneration of the holy 
warrior al-Bilawi’s image in the summer of 2014 after he was killed 
by Iraqi forces. 


Celebrated and Dead Foreign Fighters Featured in Dabiq 
Dabiq Issue 9—Abu Mus’ab al-Almani and brother, originally from 
Germany, who died in attack under Wilayat Shemal Baghdad 4th 
Regiment Base attack. 

Daqiq Issue 10—“Join the Caravan of Islamic State Knights in the 
lands of the crusades” with a batch of examples of dead fighters 
attributed to the Islamic State. 

Dabig Issue 11—Celebrated Najd attacker “Abu Sinan an-Najdi” 

Abu Ja’far al-Almani, German fighter. 

Dabiq Issue 12—Abu Junaydah al-Almani (Moroccan German). Abu 
Shurayh as-Silani (Sri Lanka). 

Dabiq Issue 13—Abu Muharib al-Muhajir (a.k.a. Jihadi John, a 
British Arab). 

Dabiq 14—Abu Sulayman al-Baljiki, Khalid al-Bakrawi (a.k.a. Abu 
Walid al-Baljiki), Muhammad Bilqa’id (a.k.a. Abu Abdil Aziz al- 
Jaza’iri), Najm al-Ashrawi (a.k.a. Abu Idris al-Baljiki)—Belgium 
attackers; 

Abu Jandal al-Bangali-Dhaka fighter, traveled to Syria to be shot by 
23mm autocannon. 


Most of the al-Hayat videos featured a foreign fighter who was 
portrayed as brave for traversing all the dangers to get to Syria or 
Iraq to fight for the caliphate. From the first releases on the 
messages remains the same. For example, al-Ghurabaa: The Chosen 
Few of Different Lands—Abu Muslim from Canada (video from July 
12, 2014), Abu Suhayb al-Faransi (video from March 7, 2015), and 
Stories from the Land of Living—Abu Khaled al-Cambodi from Australia 
(video from April 21, 2015) were all designed to exalt the holy 
warrior image as the face of ISIS instead of the face of cult members 


who were killed for the ambitions of a terrorist organization. 
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Figure 73: Canadian Andre Poulin appeared in third al-Hayat video designed to 
encourage recruits to leave Canada. (Source: TAPSTRI) 


Taliban leader Khadim was killed, and shortly after Wilayat 
Khurusan acknowledges it with tribute and worship. al-Shaykh 
Khadim has passed and the revenge is coming released in March 2015. 
In March of 2016, a video was released applauding the 
contributions of dead Emir “Abu Ali Al-Anbari,” who was killed in a 
drone strike. 


REPENT OR DIE 


In the first edition of Dabiq, ISIS claims that hundreds of Iraqi 
police, law enforcement, and military “repented” (tawba) in Diyala, 
Kirkuk, al-Anbar, and Salahuddin. In a few official ISIS video 
releases, we also see officials “repent” their previous role in 
working for the Iraq government and be claimed by the Islamic 
State. But the message from ISIS remains “Repent Before We 
Apprehend You,” which has a video title all its own released 
through the Syrian regional ISIS media office, Wilayah Dimashq. 
Being “repentant” and then joining ISIS can also result in getting 
you featured in death. A man identified by ISIS as Abu Muhammad 
al-Ansari, who was a Syrian officer (Nusayri soldier) who turned to 
ISIS, died in Minnigh. His brief story was highlighted in Messages 


from the Land of Legends 2, released in August 2013 under the al- 
Furqan Media Foundation, the lead media center for ISIS materials 
and the original publishing foundation for the organization since its 
founding under Abu Mus’ab al-Zarqawi. 


THE WOMEN OF THE CALIPHATE 


Despite the vast amount of propaganda released by the Islamic State 
or al-Qaeda, very little of it features women. The few bits that have 
been released come from their print institutions, such as ISIS official 
publisher Maktabat al-Himmah’s pamphlets and the official 
magazine, Dabiq. The articles usually tell the stories of women who 
found sanctuary in the Islamic State and understanding from her 
new peers and an awareness of her noble mission. While it is known 
that women are involved in recruiting and other clandestine 
operations, there are no images released by the Islamic State 
showing what the lives of women were like during al-Baghdadi’s 
brutal reign. 


CONDITIONS FOR A CORRECT HIJAB 


THAT IT BE HEAVY (THICK) AND NOT TRANSPARENT AS TO 
WHAT IS UNDERNEATH IT 


THAT IT BE LOOSE (WIDE, NOT TIGHT) 


EE THAT IT COVERS THE WHOLE BODY 
THAT IT IS NOT A DRESS THAT MAKES ONE STAND OUT 
qa THAT IT DOES NOT RESEMBLE THE CLOTHING OF DISBELIEVING 
WOMEN NOR THE CLOTHING OF MEN 


bipgiae THAT ITIS NOY A DRESS OF BEAUTIFICATION THAT ATTRACTS LOOKS 


THAT IS NOT SCENTED (PERFUME OR INCENSE) 


Figure 74: A graphic from Maktabat al-Himmah. 


The Voice of Umm Sumayyah al-Muhajirah 

In print, the life of women under ISIS was a vastly different world 
than the one seen in the violent videos featuring the men. In order 
to tap into the spirit of the women the terrorist group wanted to 
indoctrinate, there had to be a voice that could speak to the women 


about their role in the caliphate. 

Addressing “my Muslim sister, the wife of the mujahid and 
mother of lion cubs,” Umm Sumayyah al-Muhajirah first appeared 
in Dabiq Issue 8 with the article “Twin Halves of Muhajirin” and 
then reappeared in Dabiq Issue 9 with “Slave-girls or prostitutes.” 
She appears again in Issues 11, 12, 13, and 14. But when the 
fifteenth issue of Dabiq came out in July 2016, a new voice spoke 
for and to women: Umm Khalid al-Finlandiyyah recounted “How I 
came to Islam,” a testimony of a woman who came from a 
“Christian” nation. In her story, she describes going to join ISIS 
after her husband was released from prison. 

Narratives like the ones found in the Dabiq entries all come down 
to what ISIS wants from women—marrying ISIS fighters and 
bearing their children. There have been unofficial clips uploaded to 
the web of the al-Khanssaa Brigade or unofficial footage showing 
the treatment of women. One well-known clip included the stoning 
of a woman for adultery while her father watched. The treatment of 
women in the caliphate is mostly known through the testimony of 
women who have escaped. 


You Must COME TO THE CALIPHATE—THE HIJRAH 


MESSAGE 


ISIS media constantly reinforces “obligations” for Muslims, and the 
first one is “hijrah from wherever you are to the Islamic State” and 
to “Rush to perform it” or “Rush to the shade of the Islamic State 
with your parents, siblings, spouses, and children. There are homes 
here for you and your families.” 


pel pas posal fete) 
You strengthen their economy ch theyiise to fight us, and kill 
our sisters, our won ur children. 


Figure 75: Al-Hayat video uses blame to encourage Muslims to leave their homes 
and travel to Syria. (Source: TAPSTRI) 


If you can’t go to the Islamic State, then ISIS has a fallback option: 
“try in your location to organize bay’at (pledges of allegiance to the 
Khalifah Ibrahim). Publish them as much as possible. Gather people 
in the masajid, Islamic centers, and Islamic organizations, for 
example, and make public announcements of bay’ah. 

But if you can’t do that openly, ISIS has yet another fallback 
option: “If you live in a police state that will arrest you over such 
bay’at, then use means of anonymity to convey your bay’ah to the 
world.” 

The reason was clearly stated in Dabiq Issue 2: 


“Your publicized bay’ah has two benefits. First it is a manifestation of 
the Muslims’ loyalty to each other and to their body. (And those who 
disbelieved are allies of one another.)... Second, it is a way to fill the 
hearts of the kuffar with painful agony.” 


You Must JOIN THE CALIPHATE—THE BAY'AT 


MESSAGE 


A very common type of releases across the ISIS video spectrum is 
segments of young men holding up their hands with the index 
finger pointed up and swearing their loyalty as fighters to al- 
Baghdadi. This was typically the first video sent from any new 


region or from existing groups seeking to be acknowledged by ISIS 
and subsequently by everybody else. In addition to videos that 
come from the groups that pledge loyalty to al-Baghdadi, there are 
the videos that come from the wilayat that express jubilation at the 
announcements coming from abroad. Joy of the al-Khilafa Soldiers 
for the baya’a of their brothers in Nigeria was a release from al-Khair 
like several that came out in March 2015 after Boko Haram swore 
its loyalty to the al-Baghdadi. Then came videos from Dijlah, al- 
Furat, and others who joined in the theme. 

There are times when the videos are sent ahead of a bay’at, made 
by groups abroad as an invitation, like the Wilayat al-Furat release 
Message to the Muslims in Somalia released May 21, 2015. It was one 
of a half-dozen videos released. It was clearly intended to persuade 
al-Shabaab fighters to make alliances with ISIS instead of AQ. At 
the time, al-Shabaab fighters and leaders were split on this decision. 
In the case of Algeria Wilayat, the only video that exists from the 
wilayat was the bay’at video. 
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Figure 76: Clans in Nineveh renew their pledge to al-Baghdadi. 


In other releases like Clans of al-Sham and Iraq renew their bay’a to 
al-Khilafa from June 7, 2015, you can see tribal leaders renew their 
oath of loyalty. 


“THE BAD MUSLIMS” 


ISIS is not simply focused upon exalting the righteous. In their 
publications, much of the content is aimed at shaming Muslims by 
accusing them of submitting to the dictators under the unbelievers 
or for engaging in what ISIS calls forbidden practices. They also 
frequently call others apostates and declare Takfir or 
excommunication on them. This divide-and-conquer tactic is root to 
their message and agenda. 


The Rafidah (Shia Militias, Shrines, and Markets) 

The first group that has to be dealt with are parts of a gray zone in 
which versions of the Islamic faith obscure their belief that the 
Sunnis embody the true and pure Muslim faith. First are the 
Rafidah, or Apostates (Muslims who came to Islam but who left it 
for another religion). This term was applied to Shia Muslims by 
various Salafist groups, especially in ISIS media aimed at the 
Iranians. The title of the thirteenth issue of Dabiq was “The Rafidah: 
From Ibn Saba’ to the Dajjal”1 and focused its efforts on explaining 
that the Rafidah were “a party of shirk and apostacy.” In addition to 
quickly branding them as murtaddin (apostate), they also make the 
contrast quite stark. A Dabiq Issue 7 article’s title was “From 
Hypocrisy to Apostacy” with a picture of imams standing with “Je 
Suis Charlie” images after the Charlie Hebdo attack. The subtitle 
said it all: “The Extinction of the Greyzone.”2 

The Rafidah are the source of much angst for ISIS. One has only 
to watch ISIS media to see their aims. There are video clips of its 
members attacking the “rafidah” (Apostates or Muslims who left 
Islam), articles about their historical crimes or apostasy, and 
justifications for their mass murder by selective interpretations of 
the Quran by scholars including Ibn Taymiyyah. The conclusion 
was that the Rafidah are mushirk (loosely translated, “those who 
engage in Shirk” or polytheism, the belief in more than one God). 

It has led to the torture and execution of various bloggers and 
media activists who were condemned for sharing information 
deemed offensive to the caliphate. It seems that the caliphate alone 
has the authority to decide who will be killed and for what offense. 

In Syria, ISIS’s rhetorical attacks on Assad’s army are largely due 
to the ISIS involvement in a civil war and the fact that Assad is an 
Alawite, a minority Shia sect. 

The differences between the two sides are so great that any 
reconciliation is out of the question. The ISIS videos made in Syria 


often show what happens to government officials and members of 
the Syrian army detained by ISIS forces. 

In Iraq, their videos focus on the Shia militias from Iran and Iraq 
(called “the Safavid armies”) who are involved in fighting ISIS to 
increased hatred. ISIS posts pictures to justify its campaign by 
showing dead Sunni children killed by Shia militias, as well as Iraqi 
or Syrian forces. 


Morsi and the Egyptian Brotherhood 

ISIS referred to the Muslim Brotherhood as a cancer in Dabiq Issue 
14. Despite sharing ideological roots dating back decades, ISIS 
maintains the position that the Muslim Brotherhood is now a 
nationalist organization, seeking to be involved in secular 
institutions while participating in the politics of a sham democracy. 


The Taghut and the Liberators 

The insult of taghut or “idolator” is often used by ISIS to label other 
Muslim religious leaders as ignorant, like the pre-Islamic Arabian 
peoples who worshipped idols. Based on the revelations in the 
Quran, all authority and legitimacy comes from Allah. According to 
ISIS, all leaders not part of the ISIS hierarchy have no legitimacy or 
authority and are to be insulted with the word taghut. 

ISIS routinely aims its threats at leaders in North Africa, the 
Arabian Peninsula, the entire Middle East, and Central Asian 
regions. It calls for the overthrow of all these leaders and their 
regimes so that Allah’s will will be fulfilled and the faithful 
liberated to live under ISIS rule. 


Figure 77: ISIS video released in January 2016 aimed at leaders of North 
Africa. (Source: TAPSTRI) 


The other implication in the word was that the taghut serve their 


own self-interests. The word taghut describes a person who has 
ignored the will of Allah and is corrupt. The images in videos of 
regional leaders who are directly impacted by ISIS are meant to 
show the citizens of those countries that their leaders are beholden 
to outside forces, including the United States, France, Russia, and 
the United Kingdom. 

For example, Dabiq 9 was titled “They Plot and Allah Plots” with 
a picture of Secretary of State Kerry meeting with other leaders, 
including imams, to broker a deal to destroy the Islamic State. ISIS 
regards this as not only a betrayal by Muslim countries involved in 
this conspiracy, but also a betrayal of Muslims and a grave sin in 
the eyes of Allah. 

Masoud Barzani, president of Iraqi Kurdistan Region since 2005, 
was portrayed as a puppet of the US. A Dabiq 10 feature dismisses 
the Syrian Kurd YPG as merely proxies for American efforts. Other 
examples come from regional releases like those from Wilayat 
Khorasan, which labels the Pakistani Army as “apostates” in 
releases like Targeting the Apostate Pakistani Army in the Area of 
Khaybar with Mortars. 


The Moderates and Scholars Are Apostates 
ISIS is not hesitant to attack Muslim scholars who have criticized 
their destruction of traditional Islamic life. Segments in videos show 
Muftis and Imams who have denounced the Islamic State for its 
hijacking their religion. Then there are the segments in their 
magazines: Dabiq 6’s “Misleading Scholars” or Dabiq 7’s “From 
Hypocrisy to Apostasy: The Extinction of the Grayzone,” featuring 
two imams with small printed signs saying “Je Suis Charlie” at a 
demonstration of solidarity after the Charlie Hebdo attacks in Pars. 
In order to wage full war on Islam, the Islamic State has targeted 
the ulema, learned scholars, in order to discredit their calls for ISIS 
to cease its gross perversion of the religion. Targets of their spite 
and threats include Hamza Yusuf, Yasir Qadhi, Suhaib Webb, 
Hisham Kabbani, Bilal Philips, and Pierre Vogel. 


MISLEADING SCHOLARS 


Abū Dharr (radiyallahu ‘anh) narrated that while he was 
walking with Rasiilullih, he (sallallahu ‘alayhi wa sal 
am) said three times, “Indeed, there is something I fear 
for my Ummah more than the Dajjal.” Aba Dharr asked 
him, “What is this that you fear for your Ummah more 
than the Dajjal?” He responded, “The misleading 
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Figure 78: Abu Muhammad al-Maqdisi is a frequent target of attack by ISIS 
media releases like this panel from Dabig. (Source: TAPSTRD 


There are no scholars immune from the attacks. The mentor of ISIS 
“godfather” Abu Musab al-Zarqawi was as much a target as the 
moderates. The noted Salafist Abu Muhammad Al-Maqdisi has been 
the subject of many attacks by the Islamic State, which regards him 
as a confused apostate. In Dabiq 11, ISIS again asked the question, 
“who are the true fuqaha and scholars?” followed by “and who are 
the evil scholars?” The article had photos of al-Maqdisi and others. 

Another target of constant attacks was the Saudi Grand Mufti, 
Abdul-Aziz ash-Sheikh who has condemned ISIS and called them a 
cancer and existential threat to Islam. Dabiq 13 condemned the 
Grand Mufti Abdul-Aziz as an apostate. 


Those Who Help the Kufar Are Apostates 


In a release via Wilayat al-Furat in Iraq, there was a segment where 
an Iraqi confesses his sins against the Islamic State and expresses a 
sense of relief that he has finally gotten this burden off his chest. He 
no longer has to hide his transgressions from the Islamic State. He 
was then executed for his sins as a reminder that those who took 
action against the State would be severely punished. 

Releases like this often have titles like Wilayah Khorasan’s 
“Healing the Chest for the slaughtering of the spy” or “Harvest of 
the Spies.” Victims are forced to confess spying or working against 
the caliphate in some way when they were either entirely innocent 
of the charge or actually worked for the Iraqi, Syrian, Libyan, 
Egyptian, or other governments that ISIS currently is at war with. 

The videos and photo slideshows follow a pattern: accusation, 
confession, and then punishment to show a simple system of 
accountability under the rules set by the Islamic State. In some 
cases the victims look into the camera and plead for others to 
“listen to me please, don’t be foolish,” as if it may save their lives. 


The Media War with Al-Qaeda 

ISIS has been fighting with al-Qaeda through media since the days 
of Zarqawi. Moreover, the AQ leader ordered him to lower his 
profile and think long-term. ISIS continues to assail the veteran 
terrorist organization as out of touch and impotent. 

A fighter interviewed in Dabiq told them that many fighters were 
leaving al-Shabaab precisely because the terror group didn’t give 
bay’ah to al-Baghdadi. He also said that many of the fighters are 
from other countries in East Africa who go to Somalia for hijrah.3 


THE Goop Guys PAY ZAKAH 


As further proof that ISIS was a functioning state was a collection of 
zakah (tax) throughout its territories. The videos released are 
intended to show viewers that good citizens willingly pay their 
zakah, while those who do not will suffer dire consequences. The 
video claims to show that money collected is distributed fairly and 
supports a viable society with the judicial means to resolve disputes 
and take care of those in need. 
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Figure 79: Screenshot from al-Furqan release “And They Give al-Zakat” from 
June 2015. (Source: TAPSTRD 


THE DESTRUCTION OF SHIRK 


ISIS received wide and mostly unfavorable news coverage for the 
destruction of antiquities throughout areas under its control. The 
videos and photographs of the destruction of cemeteries in Iraq and 
Libya, wrecking the ancient city of Palmyra in Syria, blowing up the 
city of Nimrud have captured worldwide attention. The 
presentations begin with an ISIS representative standing before the 
camera and explaining why it was forbidden to worship the shrines 
and monuments of the past and that it was their duty to watch for 
“manifestations of shirk” that could lead Muslims astray. 

Videos from Nineveh have shown the destruction of the Lamassu, 
Tomb of Jonah, and other ancient Assyrian and Babylonian relics. 
Other videos from Libya show fighters kicking over graves. Clips 
from Iraq show the detonation of Shia shrines or the toppling of 
Christian churches in which the cross was removed and a black flag 
replaced it. Concerns for competition aren’t limited to Syria and 
Iraq when it comes to Shirk. Libya’s Tarabulus Media released 
“Removing Manifestations of al-Shirk” on March 16, 2015. 


Figure 80: A bulldozer destroys a Sufi shrine in Libya. (Source: TAPSTRI) 


Dabiq 8 described these destructive operations as “Erasing the 
legacy of a ruined nation,” one way to characterize the death cult’s 
attempt to erase the history of Iraq and replace it with a new 
history under ISIS tyranny. The terrorist organization prides itself 
on the destruction of early temples that predate the Prophet 
Muhammad. For example, Dabig 11, covered the destruction of the 
“Temple of Baalshamin,” which ISIS blew up in August, 2015. It 
had stood for nearly 2,000 years. 


KHILAFAH 


UNITES 


by 
monn eas 
DIVIDES > l 


Figure 81: ISIS graphic aimed at discouraging nationalism. (Source: TAPSTRI) 


ABANDON NATIONALISM 


One of the constant criticisms of other terrorist organizations by 
ISIS was that they served to bolster nationalism because this is 
contrary to the will of Allah. This was a way for ISIS to gain 
hegemony over other terror organizations, including the Taliban. 


PROPHECY 


The constant evocation of the “End Times” and the Day of 
Judgment pervades ISIS propaganda in Dabiq and elsewhere. For a 
cult steeped in death and destruction, this is hardly surprising. 
Before the day of wrath arrives there will be a showdown with 
unbelievers. This confrontation is forecast in videos, flyers, and 
elaborate pamphlets—most of the printed material is in Arabic and 
features sermons on how to prepare for the end of days. 


Figure 82: ISIS outdoor da’wah (preaching) event from November 2014. 
(Source: TAPSTRD 


REACHING THE LONE WOLF AUDIENCE 


ISIS materials, like those of al-Qaeda’s before them, urge extremists 
throughout the world to carry out lone wolf attacks. Unfortunately, 
the unstable of the world are receptive. Justin Nojan Sullivan, a.k.a. 
“The Mujahid,” was charged with material support on June 22, 
2015. He told an undercover law officer: “I liked IS from the 
beginning then I started thinking about death and stuff so I became 
Muslim.” Sullivan gave the undercover officer advice on how to 
build a silencer by passing on instructions he had gotten via the 
Internet. 

Abu Muhammad al-Adnani was the latest terrorist leader to call 
for Loner attacks in May 2016, just before Ramadan. He called for 
improvised attacks around the world as a sign that the caliphate 
was strong while calling for Muslims to prepare for the Holiest 


month of the Muslim calendar. 


THE PERCEPTIONS OF MUSLIMS USED By ISIS 


“Put simply, extremist groups use the stereotypes of their targets.” 
—Mia Bloom4 


When we first started dealing with jihadist videos, we were often 
trying to find a martyrdom video to learn what we could about an 
attacker. Even as ISIS media were preparing to release Flames of 
War, we thought we had seen the different levels of capability in 
these violent groups. The more we dug to see who was publishing 
and how they were getting it out on the web, the more we started 
seeing videos of the group with smiling kids. Despite the onslaught 
against their “nation” state, they continue to push the fantasy 
through videos that theirs is a paradise dangling on the precipice of 
destruction, they continue the fantasy of paradise though their 
video messages. There, one will enjoy only the best bread, properly 
killed sheep, and good water, all reserved for the Good Muslims 
who have sworn their allegiance to Abu Bakr Al-Baghdadi; these are 
presented in a level of propaganda equal to that of Saddam Hussein 
or the Nazis. There are two major tools of the ISIS media campaign. 
First, the initial release of products for consumption. Second, the 
reactive nature of both supporters and the targets of their 
campaigns. Using the Internet to upload files was only the 
beginning of their strategy to show the caliphate as heaven on 
earth. 

The general public perception of ISIS was understandably shaped 
by the videos of the executions of Americans and Europeans or the 
mass executions of Iraqis, Syrians, Yemenis, Libyans, Egyptians, 
Afghani, and others. But those seeking to be part of something big 
are attracted to the caliphate despite such horrors. Repetition. 
Already said. 


Figure 83: ISIS photosets show repair and upkeep of power. 


“Jannah” Gonna Believe This, but the Services Are Under 


Control 

There are many ISIS slide shows and videos that show a functional 
state in which roads are repaired, maintained, and well lit, clean 
water is supplied to residents, and the government looks after their 
welfare—if you are a believer. In Dabiq 4, they claimed that 
“soldiers of Allah do not liberate a village, town or city, only to 
abandon its residents and ignore their needs” and included 
photographs with captions such as “repairing a bridge in al-Khayr” 
or “restoring electricity in the city of ar-Raqqah.” They additionally 
promise “cancer treatment for the children of Ninawa” and “street 
cleaning services.” 

Some videos and related slideshows, however, show things like 
the hisbah patrol (religious police) keeping an eye out for people 
breaking laws about everything from the way one is dressed to 
someone sneaking a cigarette. They demonstrate what can happen 
if you disobey the Islamic State, burning cartons of forbidden 
cigarettes or flogging a prisoner for disobedience—or exacting 
severe punishments ending in death. However, they also portray the 
support of the people, with onlookers always cheering on 
punishment of the apostate, spy, or, worse, a disbeliever. 


THE MUJATWEETS 


A series of eight videos that came out in 2014 aimed at conveying a 
positive image of ISIS by making it appear that the fighters were 
happy, children under the caliphate were happy, food made in the 
caliphate was healthy, and other scenes encouraging fighters to 
come to the new utopia. 


EID, THE BEST TIME OF YEAR 


According to the media utopia of ISIS, there was prosperity under 
the shariah as enforced by ISIS. This prosperity was highlighted by 
video and photo releases covering the observance of Eid al-Fitr or 
like the title Eid Spirit in Wilayat al-Furat from Sept 26, 2015, 
celebrating Eid al-Adha or The Feast of Sacrifices, a 
commemoration of the story of Abraham’s willingness to obey God 
and sacrifice his son, Isaac. 


THE EDUCATION SYSTEM 


ISIS released videos showing children learning basic Arabic as well 
as basic weapons training starting from an early age. The education 
is geared to making future jihadists. The terrorist group has also 
released various pdfs to further indoctrinate supporters’ children 
into the death cult. 


Figure 84: Child learning Arabic. (Source: TAPSTRD 


In addition, there are dozens of training camp videos and videos 
featuring the “cubs of the khilafah,” or the child soldiers who are 
trained to be the next generation of fighters. In one case, a child 
named Abdallah was featured first in a school with other children 
before appearing a year later in a video in which he is killing a 
Russian FSB officer. 


Figure 85: Health Care Pulse. (Source: TAPSTRI) 


Figure 86: Fresh Fish Market. (Source: TAPSTRI) 


THE Foop Is HEALTHY AND DELICIOUS 


Abundant food provided by the caliphate was the theme of several 
feature photo sets and videos. There are many pictures of 
greenhouses bursting with well-tended produce or markets filled 
with good healthy food. The hisbah patrol stops in to make sure 
items sold are compliant with halal rules, while the image suggests 
there’s a world of good health under the caliphate. 

The image of the Islamic State as provider is a powerful message 
aimed at both the local and international recruiting targets. 
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Figure 87: Cigarette Burn Pile. (Source: TAPSTRI) 


No MORE SMOKING 


ISIS was keen on stomping out smoking. You might be sentenced to 
death for other vices under ISIS rule, but at least you would have 
healthy lungs. The pictures typically show a pile of recently 
confiscated cartons of cigarettes, cases of alcohol, cannabis, or other 
prohibited substances being burned. There are periodic photo sets 
released to remind people in the caliphate that indulging these vices 
are grounds for flogging citizens. Or worse. 


Figure 88: Member of the Hisbah patrol reads out the vices of others before a 
crowd. (Source: TAPSTRI) 


No More VICES, THANKS HISBAH! 


“Clamping down on sexual deviance” was very important to the 
caliphate. In Dabiq 7, ISIS blamed what it called “sexual deviance” 
on the “sexual revolution” that occurred “five decades ago” in the 
West. ISIS had ways of “curing” such deviance, which included 
throwing gay men off towers, stoning men and women to death for 
adultery, or flogging those caught possessing pornography. 

ISIS routinely releases hisbah patrol videos that show them as law 
and order enforcers for any number of violations from improper 
preparation of food, selling cigarettes, or playing musical 
instruments. Pictures are infrequently published of piles of 
instruments in burn piles. 


THE GOLD DINAR 


To complete much of the ISIS shift off the grid, there was the 
campaign known as “Return of the Gold Dinar” in which the Islamic 
State announced it would simply print its own currency based on 
gold. It came with hashtags #return_of_the_gold_dinar and a series 
of videos and photo sets and was featured in several editions of 
Dabiq. 


Figure 89: Al-Hayat advertises its videos on the Return of the Gold Dinar. 
(Source: TAPSTRD 


Chapter 12 


The Anti-ISIS Cyber Army 


Who is standing up to ISIS online? A coalition of governments, a 
coalition of private enterprises, and a range of private individuals 
who have, like cyber vigilantes, taken on an effort to eradicate ISIS 
from the Internet. The United States Government’s efforts via the 
Pentagon, State Department, and intelligence and law enforcement 
agencies are constantly being tested, since terrorist sometimes stay 
a step ahead. 

There the little consensus on how to balance public safety and the 
assumed right to privacy online. Government has a duty to protect 
its citizens. Private enterprise tech firms have a commercial goal 
that was undermined by the presence online and association with 
bad actors of any kind. Private citizens who are skilled in using the 
tools of the Internet have mounted take-down efforts against the 
ISIS media materials and channels. 


THE UNITED STATES EFFORT AGAINST ISIS ONLINE 


The Pentagon and the State Department have active campaigns to 
confront online recruiting and terrorist or criminal operational use 
of the Internet. Congress’s efforts have been limited, since it 
remains in perpetual deadlock. The White House has used its 
influence and power to call on tech leaders for input about what 
can be done to combat the online presence of ISIS. During the 2016 
elections, the presidential candidates called for a declared cyber 
war against ISIS.1 


The House of Representatives 

In December 2015, the Combat Terrorist Use of Social Media Act 
(H.R.3654) was passed by the U.S. House of Representatives. It 
requires the President to submit a strategy to congress within 180 
days of enactment that will serve counterterrorism efforts on social 
media. The key provisions include: 


e “an evaluation of the role social media plays in radicalization 
in the United States and elsewhere; 

e an analysis of how terrorists and terrorist organizations are 
using social media; 

* recommendations to improve the federal government’s efforts 
to disrupt and counter the use of social media by terrorists and 
terrorist organizations; 

e an analysis of how social media is being used for 
counterradicalization and counterpropaganda purposes, 
irrespective of whether such efforts are made by the federal 
government; 

* an assessment of the value to law enforcement of terrorists’ 
social media posts; and 

* an overview of training available to law enforcement and 
intelligence personnel to combat terrorists’ use of social media 
and recommendations for improving or expanding existing 
training opportunities.” 


The US Senate 

In July 2016, the US Senate Homeland Security Committee passed 
S. 2517-Combat Terrorist Use of Social Media Act of 2016, a 
companion bill to H.R. 3654. 

On July 11, 2016, the US Senate Homeland Security Committee 
passed S.2418-The Countering Online Recruitment of Violent 
Extremist Act. This act expands the resources for DHS in order to 
develop programs to counterterrorism including how to counter the 
propaganda used for recruitment, creating alternatives for those 
who are potential recruits. “If we can shut down their 
communications, they cannot radicalize people to conduct terror 
attacks like what we saw in San Bernardino,” says Representative 
Michael McCaul.2 

The battle to find the right balance in the law, law enforcement, 
civil liberties, and private enterprise continues to be active and 


quite dynamic. Many governments are enforcing blocks on end-to- 
end encrypted technology or in other cases banning use of Virtual 
Private Network (VPN), an internal network that acts like a closed 
loop of communication. There are many areas where the demands 
of law enforcement conflict with the needs of tech firms and social 
media companies like Twitter, Facebook, and others to assure their 
customers that they will do everything possible to protect them 
online. All parties involved have to understand that excessively 
lowering the level of protection provided to individual citizens 
entails a risk that others with advanced skill sets would be able to 
breach the communication systems used by ordinary citizens or 
even government agencies. The fact is that in the last three years 
there have been major breaches of data in the public and private 
sectors, and despite the best firewalls and other security measures, 
we still remain frighteningly vulnerable to hacking. The tech 
companies have made a case for self-policing and limited 
government interference in their operations. Leading companies like 
Twitter and Facebook justify avoiding limited government 
regulation and interference by engaging in aggressive takedowns of 
ISIS propaganda. 


United States Law Enforcement Activities 
Federal Level activities by the FBI and DOJ include a range of 
outreach efforts to social media organizations for input and 
cooperation. In February 2015, the US Justice Department met 
executives from Apple, Twitter, Snapchat, Facebook, and MTV.3 

Then, in January 2016, US anti-terrorism officials again met with 
Silicon Valley executives in a closed-door summit to discuss online 
counter-ISIS measures, with both sides realizing that government 
efforts alone might not be enough. The government was wary of 
encroaching on First Amendment rights.4 

The predominant method used for years by the FBI and other law 
enforcement agencies for monitoring ISIS jihadist activity has been 
a combination of acting on tips from concerned citizens and using 
undercover officers, informants, and authorized surveillance. Many 
of the 90+ cases before the federal courts involved a combination 
of informants and undercover confidence building with the 
suspects. In many cases there were overlapping suspects, all of 
whom were intending to go to Syria or in some cases carry out US 
attacks from within. 


US Department of State—“Think Again, Turn Away” 

The US State Department has been building coalitions to fight ISIS 
under Secretary of State John Kerry. The department that spends its 
time dealing with international diplomacy has been tasked to 
confront terrorism and online recruiting in several ways. The unit 
inside the State Department asked with confronting the issue was 
the Center for Strategic Counterterrorism Communications, or the 
CSCC. The CSCC was established in September 2010.5 

The State Department has said it was well aware of the intrinsic 
relationship jihadist expansion has with the use of the Internet and 
social media. Deputy Secretary of State and former Deputy National 
Security advisor Tony Blinken said the department could see a 
decrease in the space in which ISIS can operate online and that 
efforts via suspensions were taking their toll. 

The “Think Again, Turn Away” project was launched in 2014 
before the declaration of the creation of the Islamic State. The 
purpose of the project was to confront extremism with alternative 
messages. Using the twitter handle @ThinkAgain_DOS, the channel 
intended to spread counter-extremist ideas. But without knowing 
who the target recipients were or what channel would be used by 
them, the government use of a Twitter channel would not result in 
getting counter- or alternative messages to those likely to be 
attracted to watching jihadist materials in the first place. 

After the world saw what ISIS was capable of doing, the CSCC 
prepared a four-minute video called Welcome to the Islamic State that 
sought to use the savage imagery of ISIS to counter recruiting with 
images of tortured Muslims, mosques being blown up, and other 
terrorist outrages. The video was released September 5, 2014.7 
There was no evidence the video led to any success in stopping the 
recruiting of foreign fighters. 

The efforts of the State Department include using voices of 
Muslim scholars to refute the religious claims of ISIS. In doing so, 
ISIS then retaliates on those scholars, smearing them as apostates 
for working with Western governments, especially the United 
States. 


US Military vs. ISIS Cyber 

As noted in the Operation Vaporize section of Chapter 1, the US 
military and coalition forces have been busting media centers 
related to ISIS since it was called AQI. With big hauls of CDs, 


computers, jump drives, and terabytes of data, the kinetic effort to 
destroy ISIS media cannot be underestimated. When coalition forces 
put pressure on all the towns around Mosul in 2016, there were 
reports of ISIS media and IT techs leaving the group.s An anti-ISIS 
activist named Raafat al-Zarari told ARA News that many who fled 
were American citizens who have left the Iraq-Syria area for 
Turkey. 

In January 2016, French Air Force fighter jets bombed a building 
purported to be a key ISIS media center in Mosul. In response to the 
strike, Amaq stated that ten of the Mosul media crew were killed.9 
On August 31, 2016, the US military killed the ISIS spokesman, Abu 
Muhammad Al-Adnani. The operations continued days later with 
the death of the Minister of Information, Wa’el Al-Rawi. 


The Launch of a New Offensive by Cyber Command 
In March 2016, Defense Secretary Ash Carter and Joint Chiefs 
Chairman Gen. Joseph Dunford announced the intent to use active, 
offensive cyber operations to “disrupt ISIL’s command and control, 
to cause them to lose confidence in their networks, to overload their 
network so it can’t function.”10 The “Cyber Command” has been 
focused on state actors like the Chinese, the North Koreans, and the 
Russians. Based in Fort Meade, Cyber Command has been active 
since 2009. During the 2016 announcement about launching the 
new offensive, Carter told CNN, “We are dropping cyber bombs.” 
Defense Secretary Carter told Congress that these were the new 
orders to Cyber Command: 


e interrupt their command and control of forces 
e interrupt ability to plot 

e interrupt finances 

e interrupt ability to control population 

e interrupt ability to recruit 


ANTI-ISIS EFFORTS ABROAD 


While the laws in the United States continue to adapt to the 
changes driven by ISIS activities, countries in the rest of the world 
have their own ways of dealing with terrorism and abuse of social 
media. These range from imposing heavy sentences for viewing 


materials associated with ISIS to shutting down or blocking entire 
communication platforms in an attempt to prevent abuse of services 
like Twitter, WhatsApp, and Facebook to coordinate terrorist 
attacks or, as critics of those plans also note, to crack down on 
legitimate dissent around the world. 


Muslim Coalition Against Isis 

The efforts against ISIS in the Muslim world vary, but in the first 
two years after the invasion of Iraq in 2003 there was little in the 
way of a coalition despite the damage done to countries in 
proximity to and immediately threatened by ISIS. Jordan and Egypt 
have stepped up strikes against ISIS after attacks on their citizens. 
In both cases, strikes occurred just after videos were released 
showing execution of their citizens. 

In IT responses, many countries already practice strict controls 
over their communications and Internet usage. In particular, 
though, some countries have acted upon the concerns of cover 
planning hidden by encryption. Bangladesh resorted to blocking 
many social media platforms to cut off communications to potential 
terrorists. UAE imposed a fine of $545,000 for those caught using a 
VPN to bypass their strict one-IP system.11 


European Effort against ISIS Cyber 

Even as the UK exits the EU, the efforts to deal with technology and 
militants continues. The UK has a Twitter channel like the US State 
Department that was aimed at dissuading terrorist recruiting. As of 
September 2016, the Twitter channel had 18.1k followers and 
4,689 posts starting from July 2015, advising users to follow the 
channel for the latest information and to use the hashtag 
#DefeatingDaesh. The US State Department has morphed again, 
and the @ThinkAgain_DOS channel has 67 followers and two 
tweets. Its replacement channel, @TheGEC or Global Engagement 
Center, had 26.8K followers as of September 1, 2016. Not very 
impressive! 

The UK has also cracked down on several radicals including 
Anjem Choudhury and Abu Haleema. Choudhury was convicted in 
late July 2016 and sentenced to five years after years of incendiary 
speeches and explicit taunting of UK authorities by openly and 
widely expressing extremist views. Finally, after he proclaimed his 
loyalty to Abu Bakr al-Baghdadi and ISIS, and then encouraged 


others, the British authorities stepped in and charged him under 
Section 12 of the Terrorism Act of 2000.12 

Like Choudhury, one of the livelier characters on YouTube and 
via Telegram was extremist Abu Haleema, who regularly rants in 
videos and posts via Telegram and Twitter. He speaks in repeated 
phrases intended to cause the thoughts to sink in to the listener. In 
early January 2015, Twitter shut down his channel as part of an 
effort, reportedly directed by a combination of MI5 and CIA 
efforts.13 


Investigatory Powers Bill 

Regarding legislation, Parliament has been debating a bill that calls 
for the banning of encrypted messaging for potential terrorists 
including usage of Facebook, WhatsApp, and iMessage.14 In 
addition, the bill calls for increasing data collection of traffic 
between suspects of targeted investigations. The bill was met with 
resistance from privacy advocates, but it passed in the House of 
Commons.15 


France 
In the aftermath of the attacks in Paris in November 2015, France 
sought to work with the tech giants to deal with terrorist use of 
advanced encryption tools and the Internet for recruiting. Officials 
met with Facebook, Twitter, Microsoft, Google, and Apple.16 

In an effort similar to that of the US State Department, the French 
authorities launched a hashtag campaign under “StopJihadisme” 
meant to teach parents to look for indications that their children 
might be getting radicalized. Yet critics suggested the campaign was 
a waste that failed to reach the audience of people who would most 
likely turn to ISIS. The campaign included a video that was similar 
to the one released in the United States, a recut of ISIS videos 
meant to destroy the notion of a utopian destination for the pious 
Muslim.17 


Europol 

The European Police Office, or Europol, began efforts to find those 
behind publication of ISIS media in July 2015.18 The agency said 
the effort would include sending take-down notices with the 
demand that accounts be removed within two hours of notice. The 


effort would also include a more concerted attempt to detect 
noteworthy channels in order to flush out leaders and media 
centers. 


Silicon Valley vs. ISIS 

It wasn’t something Silicon Valley had experienced before. Since 
2003, foreign terrorists were now controlling their operating 
systems and custom coding them to spread their messages and 
recruit fighters to attack abroad. The flood of ISIS on the social 
media stage was initially overwhelming for YouTube, Twitter, and 
Facebook. The tech giants were dragged into the fight against their 
will, but they’ve had no choice but to respond. With the demand to 
clean up their sites coming from their users and lawmakers 
worldwide, each of the firms have increased their efforts to stop and 
prevent exploitation of their systems for terrorist media propagation 
and recruiting. Beyond these three, communications like Telegram, 
Wordpress, and Archive.org have stepped up efforts to remove ISIS 
from their systems. In the case of Telegram, there are intelligence 
agencies and private analytical firms who express resistance to 
removing these channels out of a need to keep an eye on the 
organization instead of driving them further into the dark. 


Twitter vs. the ISIS Fanboys 

If there was one social media outlet that was perhaps impacted the 
most during the rise of ISIS on the world stage in the summer of 
2014, it was Twitter. While many people do not know about the 
world of online forums, secret or not, they do know about Facebook 
and Twitter and have become accustomed to getting news and 
lifestyle announcements via Twitter. ISIS, AQ, and other jihadist 
groups are using the same tools for their message but with a quite 
different set of goals. 

Twitter has also announced its own war on ISIS in a company 
blog post, where it was revealed that since mid-2015 it has 
suspended 125,000 pro-ISIS or terrorist accounts. Twitter’s blog 
reported they had increased the staff dedicated to the task of 
keeping up with reports on suspicious profiles and posts submitted 
by users: 

“We have increased the size of the teams that review reports, 
reducing our response time significantly. We also look into other 
accounts similar to those reported and leverage proprietary spam- 


fighting tools to surface other potentially violating accounts for 
review by our agents. We have already seen results, including an 
increase in account suspensions and this type of activity shifting off 
of Twitter.”19 

“We condemn the use of Twitter to promote terrorism and the 
Twitter Rules make it clear that this type of behavior, or any violent 
threat, was not permitted on our service,” the blog post read. “As 
the nature of the terrorist threat has changed, so has our ongoing 
work in this area.”20 

After the Bastille Day attack, Twitter demonstrated it understood 
how ISIS would exploit the tragedy on their platform and rapidly 
suspended accounts that appeared to be pro-ISIS applauding the 
truck attack during the holiday in the southern town of Nice. When 
users posted under “#BlessedNiceAttack” or the “#BattleOfNice” 
tags and more, they were suspended in far less time than past 
suspensions had taken. 

The company defended its performance in keeping up with the 
proliferation of ISIS profiles by noting that experts in the field 
suggested it was impossible to develop the magical algorhythms 
that would perfectly detect who was participating in terrorism. 
They disclosed that they do use methods similar to their spam 
tracking that identify activities associated with accounts that have 
been identified with ISIS activities. 


Facebook vs. ISIS 

Much like Twitter, Facebook has been very active in removing 
suspect profiles, pages, and groups from its website. Facebook, in 
the past, has cracked down on ISIS-related accounts, including 
banning a company profile that was supposedly owned by the San 
Bernardino Shooter Tashfeen Malik. However, the social media 
website relies heavily on users bringing profiles to a moderator’s 
attention by either “liking” the page or “flagging” it for violating its 
community standards. 21 


Google and YouTube vs. ISIS 

Interwoven giants Google and YouTube are still used by pro-ISIS 
supporters but with far less frequency than just after the 
announcement of the caliphate in the summer of 2014. The use of 
the video tools, personal profile pages, email, and Google drives 
have made this tech giant very appealing to the jihadists. 


One of the key tech giants infected with the ISIS bug was Google. 
Through its email systems, personal websites, google drive sharing, 
and of course the very powerful YouTube, Google became the 
center of attention in the beginning of the battle with ISIS in the 
summer of 2014. With postings of beheadings grabbing the news, 
Google’s subsidiary video site YouTube was caught in the cross fire 
between the terrorists of ISIS and the demands of free speech in its 
home country of the United States. 

The use of YouTube by ISIS was an easy choice considering the 
open source nature of the platform, but it wasn’t the only video 
sharing site being used by the terrorist organization. The 
propagation teams use dozens of lesser-known sites including sites 
that are beyond the reach of U.S. legislative control. Yet Google 
wasn’t simply picked for YouTube; the terrorists exploited Google 
both for its email and its Google drives for hosting video, audio, and 
document files. 

Tech juggernaut Google announced that it would take the fight to 
ISIS by introducing an alteration of its search results. Jigsaw, an 
advanced research outfit, will redirect anyone searching pro-ISIS 
terms and phrases to antiextremist messages and videos. The 
campaign behind this was called the “Redirect Method.” 22 

Google hopes to inspire anti-ISIS campaigns by using Jigsaw 
instead of automatically integrating it into its search results. The 
campaign seemed to be effective during an eight-week trial from 
January to March of 2016, reaching at least 320,000 people who 
searched for one of more than 1,000 Islamic State-related keywords. 

The method placed ISIS-related search results close to ads that 
had links to counterradicalization links. Jigsaw and other groups 
affiliated with the method did not create new anti-ISIS content, but 
simply redirected searchers to preexisting content on YouTube. The 
effort led by Jigsaw, now a division of Alphabet, Google’s parent 
company, follows other initiatives to counter extremist messages on 
the web. The Jigsaw project comprised 30 ad campaigns and 95 
unique ads both in English and Arabic. 


Archive. org 

There are few places more interesting on the web than Archive.org, 
and ISIS knows it. They reliably use Archive.org as their primary 
depot for the highest-quality versions of their video releases, and 
the source location for their audio and pdf releases like Dabig. But 


unlike their early efforts at exploiting it, ISIS began having 
difficulty successfully keeping materials posted there for long, as 
Archive.org caught on and undertook changes to be more 
responsive in taking down the propaganda materials. 

The Internet archive, an enormous digital library, was hacked 
because it hosts ISIS materials. The Twitter account @AttackNodes 
took credit for the hacks with the hashtag #opISIS, which was 
affiliated with Anonymous. However, Anonymous members have 
not gotten in contact with Attack Nodes. 23 


CORPORATE FIGHT VERSUS LEGISLATIVE OR EXECUTIVE 


OVERREACH 


There has been a balancing act between private corporations and 
the power of the US government given its desire to stop terrorism 
and the desire of the tech firms to be able to retain customers who 
value their privacy. The tech industry has long pushed back at 
congress regarding outside policing of their systems and instead 
tends to offer plans and evidence of action to assure the legislative 
body that the industry is quite capable of taking care of itself and 
that customers have expressed concerns over privacy to the 
companies. As noted earlier, the most substantial battle came when 
the FBI asked Apple to help breach the phone at the center of the 
San Bernardino attack in December 2015. Apple refused on the 
grounds that breaking the encryption with a backdoor for law 
enforcement was not an option it would pursue. Apple claimed that 
it could not break the encryption without wiping the iPhone, but 
the FBI finally managed to succeed. 


BRAINPOWER VERSUS ISIS—THE THINK TANKS 


There are several organizations and private analysis firms and think 
tanks that are involved in the daily effort to defeat ISIS online. The 
research programs are blooming as the need for more awareness of 
what motivates people to join extremist groups like ISIS is on the 
rise. 

While there are organizations that simply observe and report 
what they see, others are engaged in direct efforts in 


counterradicalization, counterrecruitment, counterintelligence, and 
more. 


Muflehun 

Humera Khan, an executive director for Washington, D.C.-based 
Muflehun (Arabic for “those who will be successful”), said that it’s 
not enough to just shut down ISIS websites. A more coordinated 
effort was required. “The ones who are doing these engagements 
number only in the tens. That is not sufficient. Just looking at ISIS- 
supporting social-media accounts—those numbers are several orders 
of magnitude larger,” says Khan. “In terms of recruiting, ISIS is one 
of the loudest voices. Their message is sexy, and there is very little 
effective response out there. Most of the government response isn’t 
interactive. It’s a one-way broadcast, not a dialogue.” 24 


Quilliam Foundation 

A British counter-extremism think tank founded by Ed Husain, 
Maajid Nawaz, and Rashad Zaman Ali, has used its own 
antiradicalization videos to combat terrorist ideology.25 The 
foundation was established in 2007. 


Brookings Institution 

A Washington, D.C.-based public policy organization. A study led 
by J.M. Berger of the Brookings Project found that pro-ISIS Twitter 
accounts had an average of about one thousand followers. Pro-ISIS 
accounts were also found to be more active than anti-ISIS ones. 
ISIS’s successful spread of its ideology can be attributed to a “small 
group of hyperactive users numbering between five hundred and 
two thousand accounts, which tweet in concentrated bursts of high 
volume.”26 The report also found that while a minimum of one 
thousand pro-ISIS accounts were suspended from Twitter between 
September and December 2014, there was also possible evidence of 
thousands more. 


The Soufan Group 

The highly respected counterterrorism advisory firm, The Soufan 
Group, has done extensive research into the use of media for 
recruiting foreign fighters that prove invaluable to researchers 
worldwide. They also publish a daily newsletter with up-to-the- 


minute analysis on terrorism around the world. 


STUDENT POWER 


Outside of tech companies, college students have been recruited in 
the fight against ISIS. The US departments of State and Homeland 
Security, Facebook, and Ed Venture Partners have created a 
competition to challenge college students to promote anti-ISIS 
ideology via social/digital media. 

In 2015, students from Missouri State University won the 
competition with their campaign called One95. The campaign had a 
website, testimonial videos, and a tweet-a-thon. The group’s efforts 
turned into 200,000 Facebook and Twitter impressions. Eventually, 
the One95 Global Youth Summit against Violent Extremism was 
held in the fall of 2015 at the UN in New York.27 


THE GRASSROOTS FIGHT 


In what may be a precedent in the history of cyber war, citizens 
were continuing to get involved in the fight. With a range of forces 
from moms who decided they had to confront the terrorists who 
radicalized their sons to lone cyber warriors like “Jester the mystery 
hacker,” who posted credits for taking down forums and inflicting 
other mayhem against the Islamic State to the news headline- 
grabbing fight between Anonymous and the terrorist group. 


Figure 90: Anonymous Logo. (Source: TAPSTRD 


Anonymous vs. ISIS 

Evolved from users of 4chan, an imageboard website launched in 
2003, Anonymous has become the most recognizable name in 
hacking and activism or the more common portmanteau term 
“hacktivism.” Anonymous gained attention through its history of 
focusing campaigns against Scientology in its “Project Chanology” 
in 2008; Operation Payback in 2010, which consisted of a series of 
DDoS attacks against companies and law firms fighting online 
piracy; and their operations focused on groups seen to be racist or 
bigoted by Anonymous including the KKK (2015), Storm Front 
(2015), and Westboro Baptist Church. It has intervened in cases like 
the Steubenville rape case of 2013, or the Ferguson, Missouri, 
shooting case of Mike Brown, or even launched a DDoS attack over 
police officer Jeffrey Salmon’s shooting of a dog, which was 
captured on video in June 2013. 

Anonymous also has little fear about threatening violent 
organizations. In October 2011, the group threatened the Mexican 
drug cartel, Los Zetas, with releasing personal information that 
could harm the Zetas if they didn’t release an Anonymous member. 
The group attacked the CIA’s website in 2012 and the Interpol 
website in 2012.28 


#OpISIS Begins 
How Anonymous went to war with ISIS: 


ISIS; We will hunt you, Take down your sites, 
Accounts, Emails, and expose you... 
From now on, no safe place for you online... 
You will be treated like a virus, And we are the cure... 
—Anonymous 


In response to the shootings at the Charlie Hebdo offices on January 
7, 2015, in Paris, Anonymous declared war on al-Qaeda and what 
would become ISIS in its campaign to destroy jihadist websites and 
social media accounts. #OpCharlieHebdo was crafted to attack 
jihadist online resources in retaliation for the murder of twelve 
people.29 The first site Anonymous claimed to have knocked down, 
ansar-alhaqq.net, was only down for a few hours before it 
reappeared. On February 9, 2015, Anonymous claimed to have 
removed 800 terrorist Twitter accounts and a dozen Facebook 
accounts.30 


Paris Attacked Again 

In November of 2015, days after the terrorist attacks in Paris that 
killed 129 people, Anonymous issued a video promising retaliation 
against the group. “The War has been declared,” the voice started in 
French. “Prepare yourselves. These attacks cannot remain 
unpunished. This is why the Anonymous from all over the world 
will hunt you down. Expect many cyber attacks.” The video then 
closed with expressions of condolence for the victims and families 
of the attacks that rocked the French capital. 

Shortly after it initially began its “war” with ISIS in November, 
Anonymous claimed to help get 5,500 ISIS Twitter accounts taken 
down, which supposedly jumped to 20,000 by mid-February 
through its operation “#OpParis.”31 The hacktivist group claims to 
have foiled an attack in Italy because of its efforts, all a part of its 
“Operation Isis” campaign.32 


ISIS Responds to Anonymous 

Though ISIS fanboys often pay attention to their opposition, they 
don’t always take the time to respond. However, in a post on 
November 17, 2015, on a pro-ISIS Telegram channel came a taunt 
aimed at the virtual nature of the group. “What are they gonna 
hack?” 


The Brussels Attack 

ISIS attacked the Brussels Airport in Zaventem and the Maalbeek 
metro station, killing 32 people and injuring more than 300. 
Following the attacks on March 22, 2016, Anonymous released a 
video threatening ISIS again. 

“We have laid siege to your propaganda websites, tested them 
with our cyber attacks, however we will not rest as long as 
terrorists continue their actions around the world,” a masked 
spokesman said in the video.”We will strike back against them. We 
will keep hacking their websites, shutting down their Twitter 
accounts and stealing their Bitcoins. We defend the rights of 
freedom and tolerance.”33 


The Orlando Response 

Omar Mateen struck Pulse, a gay night club in Orlando, Florida, on 
June 12, 2016, killing 49 and injuring 53 others. The event stunned 
the nation. Following the Orlando shooting, Anonymous hacked 


pro-ISIS Twitter accounts and flooded them with Gay Pride 
messages, photos, and banners.34 The hacker operating under the 
name “WauchulaGhost” breached several accounts and repurposed 
the look of their graphics to a rainbow décor and phrases like, “I’m 
Gay and I’m Proud!”35 


Effectiveness 

Anonymous has its detractors in the counterterrorism game. There 
are many analysts who have criticized the group for its lack of 
discernment regarding accounts attributed to ISIS. This results in 
accounts being falsely flagged for being Islamic in nature and tone 
but not associated with ISIS. Twitter issued a confirmation that it 
took down accounts accused of being ISIS that turned out not be 
ISIS-related.36 


Ghost Security Group (GSG) 

One group that sprung from the Anonymous versus ISIS battle was 
formed by a hacker named Mikro and directed by another named 
DigitaShadow. After breaking away from Anonymous in May 
2015,37 Mikro launched two groups to combat ISIS, the Ghost 
Security Group (GSG) and CtrlSec. Ghost Security Group started 
with an intentionally different angle from Anonymous that included 
cooperating with law enforcement and private security firms and 
being willing to get paid for the work. 

GSG describes itself as a “counterterrorism organization” focused 
on terrorism only, whereas Anonymous was known for shifting 
focus when an outrage calls. One minute Anonymous may be 
focused on Charlie Hebdo, and the next it was aimed at Ferguson, 
Missouri. GSG claims its focus was consistently aimed at ISIS and 
related groups. 

The group doesn’t reveal its methods or logistical arrangements 
as an organization. Gizmodo stated that GSG claimed 16 members 
in the United States, Europe, the Middle East, and Asia.38 They also 
noted that DigitaShadow had come into the crosshairs of law 
enforcement because of participating in DDoS (Distributed Denial of 
Service) attacks related to Ferguson, Missouri, protests.39 

In July 2015, GSG made the claim that it had intercepted 
information while doing network analysis on Dark Web sites that 
uncovered a plot to attack a Tunisian market. This would have been 
a follow-up attack to the June 2016 beach attack in Tunisia. The 


group cooperated with a private security firm known as Kronos 
Advisory to then send the information to the FBI. The outcome was 
not revealed. 

There was another group affiliated with Anonymous called 
“Ghost Security” that has become a rival group due to the criticism 
of GSG’s cooperation with government law enforcement agencies 
and private security firms like Kronos Advisory. In late November 
2015, the GhostSec hacktivists attacked the Isdarat site on the Dark 
Web used to host videos and gave it a Prozac rebranding. 40 


The Atlantic Profiles GSG Founder Mikro on ISIS 

One hacktivist, named Mikro, who was a member of Ghost Security 
Group, was profiled in an article by the Atlantic magazine. Mikro 
was supposedly an “operations officer” for GhostSec, a group whose 
mission was to target “Islamic extremist content” from “websites, 
blogs, videos, and social media accounts,” using both “official 
channels” and “digital weapons.”41 So far, the group claims to have 
overwhelmed servers in more than 130 ISIS-linked websites in 
coordinated attacks.42 


Formation of CtrlSec 

Mikro later formed a second group, this time not affiliated with 
Anonymous. The new group was dubbed CtrlSec. While similar to 
GhostSec, CtrlSec accepts financial support and has a defined 
structure and hierarchy, unlike Anonymous. Its goal was to shut 
down pro-ISIS Twitter accounts. On a near-hourly level, the four 
Twitter accounts associated with CtrlSec (@CtrlSec, @CtrlSecO, 
@CtrlSec1, @CtrlSec2) publish links of Twitter accounts targeted 
for take-downs. Mikro claims to have shut down tens of thousands 
of accounts with the group.43 


Figure 91: Jester Logo. (Source: Jester) 


The Jester (th3j35t3r)—The Cyber Vigilante 

Before there was #OpISIS, there was ‘th3j35t3r’ and his efforts to 
destroy jihadist web sites and materials found on the Internet. 
Described sometimes as a “patriot hacker,” Jester has used his skills 
to confront not only ISIS, but Anonymous, as well. He claims to be a 
“former military man” and often speaks in military jargon. His fight 
with targets like Anonymous, Wikileaks, Westboro Baptist Church, 
and jihadists all intersect at an interest in looking out for the 
welfare of members of the military. Hitting the Twitter scene in late 
2009, Jester has been documenting his fight against online 
extremists for years and across several platforms including iAWACS 
(online surveillance), Xerxes (DDoS program), and other home- 
brewed web tools.44 

Jester reportedly got into hacktivism in reaction to Wikileaks 
releases. He claims he was concerned that files exposed by the 
organization would endanger our troops. Because Anonymous was 
very much aligned with Wikileaks, the fight expanded to them, too. 
He’s shown strong animus against Anonymous, their rival group 
Lulzsec, and Wikileaks. 

He then moved on to Islamic terrorists.45 His first claim to fame 
was taking out a Taliban site, alemarah.info. On January 1, 2010, 
he Tweeted, “www.alemarah.info is now under sporadic cyber 
attack. This ‘Voice of Jihad’ served only to act as a tool for terrorist. 
OWNED. By me, Jester,” after he hit the site with a DDoS attack by 
his customer customized DDoS tool codenamed XerXes. 
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Figure 92: Jester Tweet 1-alemarah.info. (Source: Twitter) 


He proceeded for years to take down site after site, each time 
punctuated with his trademark tag Tango Down. A check of his 
Twitter time over the years shows a long list of take-downs starting 
with the January 2010 toppling of the Taliban site. He says he 
stopped keeping up with how many sites he’s taken down after he 
topped 179.46 
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ansar1.info - TANGO DOWN - for spreading 
that jihad BS, trying to recruit via proliferation 
of 'Inspire Mag' - Here's a cupcake. 
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Figure 93: Jester Tweet 2-cupcake specials. (Source: Twitter) 


“Approximately five years ago I realized that there was a growing 
threat from jihadis online using the Internet to recruit, radicalize, 
and even train homegrowners,” The Jester told NBC Chicago. “I 
decided to research their favorite haunts, collect intelligence on the 


users and admins and in many cases remove them by force. I tended 
to hit some sites a lot and leave others. This had the effect of 
herding/funneling them into a smaller space. And smaller spaces 
are easier to watch and monitor.”47 

One of his next operations was to use a Libyan newspaper to 
spread disinformation. His psychological operations campaign 
began just before the toppling of Muammar Gaddafi in 2011. He 
appeared to have fabricated articles in the online feed of the Tripoli 
Post in March 2011 in order to affect troop movements in the 
region. His method was determined to be the use of a code injection 
in the link he provided via a bit.ly url, which included an additional 
link to offsite content that was aimed to suggest that Gaddafi’s army 
was abandoning him. 

He has successfully eluded being outed despite a range of 
opponents, including Anonymous and many nation states, who 
clearly would love to do so. His websites and social media accounts 
have been suspended several times over suspected hacks including 
having his domain name, jesterscourt.cc, seized by the US federal 
government.48 

“[T]he bad guys want to slice my head off on YouTube with a 
rusty blade, and the good guys want to lock me up in an orange 
jumpsuit ... along with the bad guys.” 49 

Jester’s criticisms of Anonymous have been well publicized in the 
hacker-oriented news blogs. He has stated the amorphous group 
lacks a check on their efforts to confront ISIS, that they aren’t 
serious, and that they are largely ineffective. 

“All they’ll do is dump a random list of names from a previous 
hack and claim it’s ISIS members, and they’ll report ‘ISIS’ accounts 
to Twitter. Pretty standard BS from them,” he told Paul Szoldra 
from Tech Insider in Nov 2015.50 

Compared to the Anonymous hackers who focus on ISIS, The 
Jester sees himself as more of a patriot, looking to protect US 
citizens from those he deems a threat.51 In an article on his official 
website, in July 2015, he criticized the US government’s efforts: 


I didn’t go out of my way to broadcast my approach except in a select 
few places. It was quite simple. I made it my mission to “constantly 
disrupt and/or disable their self-managed offshore servers, to sow 
distrust among the users and total frustration among the site 
administrators ... strive to make it too much of a pain in their 
puckered asses to bother using their own resources ... thereby forcing 


them off those boxes and ‘herding’ or ‘funneling’ them into a smaller 
space. Because smaller spaces are easier to watch and monitor.” The 
whole effort was well-documented and relatively successful, in at least 
179 cases (via CNN) and independently confirmed here (by NBC).52 


In the end, Jester’s view is simple: “You can ask an ISP nicely to 
perform a takedown, but mostly they don’t, that’s where I seem to 
fit in.”53 

Interesting bit: When Jester decided to attack the controversial 
Westboro Baptist Church’s website over their protests at soldiers’ 
funerals, he did so with a 3G phone. 


AVOIDING SPY ON SPY 


The rush to take down ISIS materials has raised an issue on 
accountability related to who should decide what is taken down and 
how will that be decided and how do take downs affect others. On 
the real battlefields, coordination between allied forces is 
paramount to mission success and vital to the safety of friendly 
forces. In the cyber world, the same rules apply and may even have 
life-and-death consequences. The stakes are high when undercover 
operations lurk behind the channels of Twitter and Facebook or on 
websites, forums, or hidden channels. The court records alone 
indicate extensive contact between federal agents or informants and 
terrorists or soon-to-be terrorists. Therefore, the takedowns of 
jihadist materials run the risk of blinding or harming those 
operations. 

In 2008, a website used by the CIA and the Saudi Government to 
conduct intelligence on extremists in Iraq and the Middle-East 
region was taken down.54 The site became the focal point of an 
intense debate in Washington, as policy makers tried to defend the 
validity of the concerns. On one hand, the CIA was looking to lure 
terrorists to the website so they could corral and gather intelligence 
on their activities. On the other, the US military and others argued 
that the content posted would lead to further threats against US 
troops, especially in Iraq. In the end, the US military won out, and 
the site was targeted, just as US Central Command wanted. The 
group tasked with the assignment was called the Countering 
Adversary Use of the Internet program under the Fort Meade-based 
Joint Functional Component Command-Network Warfare. 


Another example concerns the use of the web to archive jihadist 
materials. Researchers gather ISIS material so it can be reported to 
appropriate authorities and analyzed for intelligence value, but non- 
Arab speakers may not realize the purpose of the site and flag it for 
removal. A blogger at InfoSecIsland.com published a review of 
Jester’s take-down effort and noted that he had taken down a 
research site hosted by the blogger. The blogger stated that a little 
bit of examination might have led a reasonable person to realize 
that the site owner was a critic of ISIS, not a supporter.55 

The FBI is known to have used the Internet to lure suspects to 
click on terrorism cases like Michigan resident Khalil Abu Rayyan.56 
Therefore, it is reasonable to conclude that if the average citizen 
issues a take-down on a Twitter, Facebook, or other type of profile 
without knowing what activity is occurring behind that channel, 
then they may disrupt an ongoing investigation into a terrorism 
case. 

One solution to this problem would be to continue to ensure 
public participation while having the tech companies who are stuck 
in the middle turn over the complaints to law enforcement and 
leave the judgment of terrorist determination to law enforcement. 
This could provide accountability for operations and places the 
greater burden of consequences on law enforcement to handle 
criminal behavior instead of the companies in the middle. A fast 
track system to the federal government from the social media, 
hosting, ISP, and other responsible parties who fall between the 
users of the Internet and terrorists would help facilitate the 
notification. Those records could be checked against undercover 
operations and work to prevent disruption of investigations. 


Chapter 13 


Tracking ISIS in Cyberspace 


LOCATING THEIR PHYSICAL MEDIA CENTERS 


ISIS media offices are scattered around the terrain they physically 
control, but this doesn’t mean any one of them has to operate in 
any physically restricted manner. The footage that was released by 
ISIS media offices still has their local report messages, which 
indicates that it still takes local teams to film, gather, and 
disseminate footage. The footage out of Syria was still focused on 
Assad and the kufar, whereas the footage out of Iraq was focused on 
Shia militias, Kurdish leaders, and, of course, the kufar. The same 
was true of releases from abroad; the tone remains local even if 
unified. This indicates there are still nodal centers that can be 
targeted for lethal force or infiltration. 

US-driven coalition forces conducted raids on media centers 
across Iraq several times over the period of occupation. In the past 
years of fighting ISIS, the coalition forces have targeted media 
leaders like the Minister of Information (Propaganda) and the 
Spokesman. From Abu Maysara al-Iraqi to Abu Muhammad al- 
Adnani, the coalition forces have targeted the spokesman. From 
Muharib Abdul Latif al-Jubouri to Wa’el Adel Hasan Salman al- 
Fayed, the Minister of Information has been targeted right alongside 
the spokesman. With an evolving battlefield, cyber targets like 
Junaid Hussaid and Mohammed Emwazi, most commonly known as 
“Jihadi John,” became key targets not unlike the targets on the 
fields of Syria, Iraq, or Libya. 


Figure 94: Locals watch a video presented on one of the many media spots set up 
by ISIS. (Source: TAPSTRI) 


Observing Media Hot Spots 

Though it doesn’t technically fall into the context of “cyber” or 
“online” activity, it is worth nothing that ISIS uses “media spots” to 
aim propaganda at its own people. At these kiosks, stands, or 
conveniently established centers, ISIS displays its latest videos, 
audio clips, and editions of an-Naba or other publications. There are 
numerous photo stories and video clips that feature ISIS media 
spots. ISIS relishes telling the world that its children and youth are 
taking in this propaganda. They watch with fascination the acts of 
horror committed by the terrorist regime. These kiosk stands act as 
nodes for observing, tracking, and identifying media, cyber, and 
communication centers. This may have been the technique that led 
the French Air Force to track and destroy a major ISIS production 
facility in Mosul. 


DISCOVERING NETWORKS 


Key to finding what ISIS was doing was discovering where they 
were, and, more important, which areas could be productive in the 
effort to stop their physical attacks. Finding their areas of 
communication was an ever-evolving task, but you can increase 
your chances by tuning into what ISIS was telling its followers 


about preferred technology, including channels, methods, and tools. 
If you map out the various ways they currently discuss their use of 
communication tools, you'll find they are using a fairly easy-to-use 
set of apps and forum tools that aren’t as cryptic as much as the 
news echo chamber makes them out to be. The average ISIS 
follower is not ultimately that technologically advanced. But this 
doesn’t mean they can’t be trained to do harm. 
What methods can be used to determine ISIS activity online? 


Human Intelligence (HumINT) 
The most reliable method for finding where important ISIS websites 
and forums exists comes from the members themselves. This 
happens in Telegram every day. Members of one channel will 
publish links to other Telegram channels that belong to Amagq, 
Nashir, or perhaps Online Da’wah Campaign. ISIS Twitter users 
engage in extensive linking to ISIS material on a regular basis. 
Without asking a single member where the party was, you can 
easily hear the sound of nasheeds on the net so it can be found. 
Another method is to observe the comments found on social 
media posts where followers drop hashtags and other momentary 
indicators of their campaigns or concerns. Using this information, 
you can expand your search to find forums and other social media 
outlets where supporters are congregating, posting, or sharing. 


Media Comparison Tools 

The digital thumbprint of media files can help investigators and 
analysts find additional postings. Even without sophisticated data 
mining tools, by taking a single ISIS video banner and uploading it 
to Google’s image tools, you'll discover other locations where the 
photo may exist. This can be used with Twitter avatars or other 
types of photos to expand the search for locations used in the 
Surface Web that are being used by ISIS or other groups. 


End User Data Seizures 

A sure way to be able to examine how ISIS uses the Internet is to 
examine in detail all of the gadgets and social media tools used by 
ISIS followers. The communication apps, the choice of gear, the 
sophistication of the operative all help identify the Internet regions 
of operations. 


Data Mining and Traffic Analysis 

Traffic Analysis around keywords or media—The big picture on 
traffic over files or text can give investigators strong insight on the 
activities, perceived abilities, and numbers of supporters. 

In 2016, Twitter banned US government intel agencies from using 
Dataminr to mine accounts in search for terrorists.1 Dataminr 
services are available to a wide range of corporate customers 
ranging from news services to financial services firms that can track 
real-time metadata. One skirmish in the conflict that caught the 
attention of the news media was when Twitter was taken to task for 
allowing RT, which was Russian state-run news, to use Dataminr for 
its services and denying the same tools to the CIA.2 

Other notable programs available to conduct data collection and 
analysis include Geofedia, another tool that collects data that can 
be used to track real-time events based on Instagram, Twitter, 
Facebook, PATHAR Dunami3 social media analytics SocioSpyder,4 
and TransVoyant “Live Predictive Intelligence.”5 


DEFENDING AGAINST THE CYBER CALIPHATE ARMY OR 


OTHER CYBER THREATS 


It is without a doubt important to stress the key to security in your 
IT systems—keep your server’s security systems, operating systems, 
apps, plugins, or any components used on gadgets, computers and 
websites up-to-date. The very reason updates exist is to patch 
vulnerabilities in programs or systems. Failing to update these 
components or systems for any reason leaves the system vulnerable 
to breaches or attacks. Servers should be stress-tested and put 
through various penetration tests by professional “white hat” teams 
to expose vulnerabilities before you are vulnerable to threats from 
hackers in CCA, other groups, or even common malware. 


Content Management Systems 

If you use Content Management System (CMS) sites like Wordpress, 
Joomla, or Drupal, make sure the site’s components are up-to-date. 
Patches for both the CMS core parts and available plugins can be 
automated in some cases. These systems are prime targets for the 
hackers of ISIS, according to many of the releases featuring account 


login information. Content Management Systems are easier targets 
because of the ubiquitous nature of their core operating parts. 
Hackers can save time by mastering the vulnerabilities of a narrow 
but very common system. Websites that display login locations in 
public view are especially vulnerable. 


Plugin Updates 

Parts in systems like Wordpress or Joomla always place the admin 
systems in the same locations. If a hacker can begin to identify 
those locations by simply typing the same login they would be 
given if using the same system, then the vulnerability of access 
begins at the front door. Some systems allow for an alteration of 
where that login exists. In other cases, plugins are available for 
several systems that allow customization of the admin logins. Also 
make sure that usernames are not published on websites; use real 
names instead. Protecting usernames is half the battle. Hackers can 
often tell the usernames by reading posts and checking metadata. 
Make sure websites and other areas where user IDs can be seen are 
checked and obscured or removed. 


Reinforce Technical Training 

Make sure the IT staffs technical knowledge of the systems and 
their potential vulnerabilities is up-to-date. For individuals, 
remember that computers are very powerful tools that can do more 
than Solitaire and Paintbrush. Computers running outdated systems 
are a gold mine for hackers; the system is like a big hunk of Swiss 
cheese, and hackers will see all the holes. Make sure unattended, 
seldom-used computers are up-to-date when accessing the Internet. 


Be Alert for Social Engineering 

Because many hackers are aware that good social engineering on a 
target may lead to better results, it is good to make sure that 
companies, employees, educational facilities, staff, students, 
government officials, military, and financial institutions are well 
educated about methods for social engineering and how hackers use 
that information to gain entry to systems. 


Password Management 
Regularly change passwords and make sure they are complicated. 


There are many online locations that can help generate high-quality 
passwords of any string length to meet the highest standards. Many 
people tend to rely upon memory for passwords out of convenience. 
This is well understood by hackers who often follow the “Keep It 
Simple” approach to a breach; “password123” is not a suitable 
password if the intention is to keep a system secure. Whereas, 
“W[{1U]L&A?D;#9%K+ E” will keep them busy and setting off 
cyber alarms while they’re trying to break in by password guessing. 


Avoid Being Phished 

Spearphishing is a method used to trick a specific target of a cyber 
attack into assisting in the attack by clicking on an email that was 
either laden with malware attachments or has links to malware 
attachments. The key to the spearphishing campaign is social 
engineering. Understanding the target allows the attacker to 
customize details that further lower the guard of the intended 
target. Getting an email address from a colleague in a small firm or 
friend-to-friend may not be that difficult, but getting emails on the 
large-scale institution often only requires looking at the company 
website. 

To avoid being targeted in this manner, make sure never to 
download attachments that you aren’t expecting and verify ahead of 
time that someone is sending you files you should expect, including 
and especially formats. Example: “I will be sending you a pdf when 
we're off the phone” along with the email is a good basic method to 
avoid confusion over attachments from a friendly source. 
Additionally, organizations, government agencies, and private 
enterprise should advise staff about the latest cyber threats that 
may affect their use of computers. They should also help install 
quality protocols that prevent anyone unknown to the system from 
entering it by blending with masses of employees. 

Good IT security is only as good as that one employee who didn’t 
know it wasn’t “Pete in the computer department here, sorry, we’re 
updating the systems here and I need you to update your password 
for me. I’ve sent you an email so we can do this quickly, I’m sure 
you’re busy.” The subject looks at the email, and it appears to be 
legitimate until they click the link and find out eventually the hard 
way they were the target of a spearphishing campaign. Therefore, it 
is important that verifications are in place to make sure that 
breaches do not occur. 


ON THE OFFENSE—KILLING THE NARRATIVES 


Harry Sarfo, a German fighter who traveled to Syria and wound up 
in an ISIS video from Wilayah Hims, says he lost faith in the ISIS 
cause while the group carried out executions in Palmyra.6 
According to an interview with Rukmini Callimachi, once Sarfo 
realized that the videos were not spontaneous actualities but were 
in fact arranged with multiple takes and lots of preparation, he 
realized he’d been had. He says that he was asked to kill one of the 
captives and that man stated he was a Sunni imam. As a result, he 
ran for his life back to Germany to face the court. 


Capture Raw Footage from ISIS 

When caught with raw video footage, many ISIS fighters look like 
Keystone Cops. In one video obtained by Peshmerga, you can see 
the ISIS fighters argue over how to fire an rpg, flying gun rounds, 
and then get taken out by Peshmerga fire. When displayed on 
unedited video, ISIS doesn’t look as heroic as it does in its polished 
and highly scripted videos and slide shows. 


“Thumb Drives Secured!” 

Seizure of data in Sensitive Site Exploitation operations, also known 
as “Shoving everything we capture into a bag,” have yielded 
massive troves of information about ISIS. In 2007, an ISI safe house 
raid in Sinjar yielded data on fighter networks. The previously 
described May 16, 2016, Delta Force operation on Abu Sayyaf 
captured computers, devices, and data from the raid in eastern 
Syria. The resulting information haul led to more ISIS leaders being 
located and targeted for airstrikes.7 Jump drives seized in raids near 
Manbij have helped unlock more of the keys to the caliphate.s 


Operation Gallant Phoenix 

When a goldmine of information was secured after the fall of ISIS in 
the northern Syria town of Manbij, the data found its way to the 
intelligence coordination center in Jordan run by the Pentagon.9 
The reports of the haul indicate that over 10,000 documents and 
4.5 terabytes of information on the individuals and operations of 
the terror group was successfully retrieved after the SDF (Syrian 
Democratic Forces) and the Kurdish YBS (Sinjar Resistance Units) 
and YJE (Yazidi Women’s Units) militias drove them from the town. 


Catalog All Gear Used by ISIS 

Every time there was an event tracked at TAPSTRI, we kept records 
of technical equipment seen in media or identified to us by law 
enforcement that was used by attackers and accomplices to keep 
track of the end result of what was used vs. what was available or 
suggested. Laptops, hard drives, jump drives, flash-media cards, 
cameras, email accounts, martyrdom video files, and software used 
to communicate are all vital assets to assess how ISIS was and is 
communicating with and advising their attackers and support 
teams. It helps also to compare these end-user tools to advice given 
to followers in security channels and try to determine whether or 
not the end user in an attack followed suggested OpSec or deviated. 
If they deviated, was it intentional, and if so, why? 


Counter-Hacking: Use of Malware and Other Asymmetric 
Operations 

The FBI and DEA have used various programs for cover surveillance 
on targets. It is a method not without its critics. Yet these tactics are 
available and have been used against ISIS targets by the terror 
group. ISIS uses these techniques against their enemies, as they did 
with Abu Majad, a vocal critic of ISIS from Syria. They tried to 
spear-phish him with an email seeking to steal his login credentials. 

Used in reverse, the technique has possibilities for surveillance on 
the gear used by ISIS to track their whereabouts, capture their 
keystrokes, observer their contact lists, and even wipe the gear’s 
memory on the way out. The available tool kit against ISIS should 
have a wide selection of tools for surveillance and data collection 
targeted at known ISIS members. Applicable laws related to 
warrants and probable cause could still apply in the US. 

Additional intrusions could involve website infiltration and data 
extraction to gain information on site users. Seizures of forum 
databases can yield a trove of information on users, admin ranks, 
and other metadata found in the site logs. 


Honey Traps 

Entrapping a target into recruiting after luring them with the 

promise of a relationship with a young woman. Young men from 

around the world are falling for this method of luring them to Syria. 
Areeb Majeed, a young Muslim man from Kalyan, India, fell for a 


honey trap on Facebook under the name of Tahira Bhatt, a.k.a. 
“umm-al-homsi,” or “umm bakiya-al-hamsi.”10 Majeed was set up 
via a social networking site. To back up the fiction, a real person 
with another account under the name “Jaanbaaz Omar” was used to 
convince Majeed that Bhatt was real and “Jaanbaaz Omar” was her 
brother.11 Women in India were told that they would be needed for 
honey traps. When it came to Majeed, he believed he’d have a wife 
when he got to Syria to fight and instead found himself unable to 
participate in battles, delivering water to fighters and cleaning up 
behind them. His dream of love shattered, he returned to India to 
face charges.12 


Use of Infiltration and Informants 

Twenty-one-year-old Khalil Abu-Rayyan wanted to get married, and 
to do so he was willing to brag to a woman online that he 
fantasized about attacking churches. Unfortunately for Rayyan, the 
confession was to Jannah Bride, who turned out to be an FBI 
informant. Use of informants is one of the leading methods for 
catching suspected terrorists and discovering the networks behind 
their usernames, although cases involving informants and 
undercover law enforcement are sometimes met with the accusation 
that the operation was an entrapment (as in leading someone to say 
they will do something they really aren’t prepared to do). Coaxing a 
suspect to admit he or she is prepared to commit a violent action 
uses personal rapport building, still perhaps the best method to find 
out what a potential terrorist will do. 


TROLLING 


Anonymous and others have taken to creating parody accounts and 
seeking to disrupt real accounts in a manner that may have made 
Abbie Hoffman proud but begs the question—how effective was it 
when applied to the big picture? While some members of the 
#OpISIS advocates may enjoy getting the laughs on the time of the 
ISIS fanboys, some researchers like J.M. Berger suggest this only 
fuels the other party’s antagonism or at the least was not very 
helpful. According to Berger, “there is a lot of evidence that trolling 
and antagonistic communications are counterproductive.” 


Chapter 14 


The Ghost Caliphate 


In 2007, the Idaho National Laboratory ran an experiment to 
demonstrate how a cyber attack could destroy the physical devices 
connected to the national electrical grid by inserting malicious code 
into a power management computer. In what is known as the 
Aurora Generator Test, White Hat hackers developed the code that 
sent a 2.25 megawatt diesel generator out of control; it was 
destroyed when it exploded within three minutes. The video, which 
can be found on the Internet, is dramatic, but had this generator 
been attached to an actual power grid, the effect would have been 
traumatic. 

The cyberwarfare developments of the early twenty-first century 
were not lost on the Russian intelligence agencies, the FSB and 
GRU. They captured a set of malware known as BlackEnergy1, 
created by a private Russian hacker, that was designed to stop web 
traffic through Distributed Denial of Service (DDoS) attacks. The 
FSB upgraded this malware into a version called BlackEnergy2. In 
2008, they launched it and carried out a DDoS attack that took 
down the entire Internet system of the nation of Georgia during a 
military operation by Russian forces. Another variant of the 
malware, BlackEnergy3, also called Sandstorm, successfully 
disrupted physical energy infrastructure through the introduction of 
malicious code. It knocked out three Ukrainian power plants 
simultaneously, removing power to 80,000 customers. 

In 2012, Saudi Arabia’s oil company Aramco was hacked by 
suspected Iranian intelligence agencies in what is considered to be 
the single largest hack in history. Some 35,000 computers 


connected to Aramco’s Intranet went off-line in one fell swoop. A 
shadowy group named “Cutting Sword of Justice” claimed 
responsibility and installed on each computer the image of a 
burning American flag.1 

The attack was technically a Fire Sale, the virtual destruction of 
all aspects of Aramco’s internal communications Internet email and 
removing their ability to process 10 percent of the world’s oil sales. 
The method of malware infection was through a spearfishing virus 
email sent to an Aramco employee who clicked the link that 
unleashed the malware. 

Between 2012 and 2013, seven hackers connected with the 
Iranian Revolutionary Guard Corps (IRGC) conducted increasingly 
disruptive DDoS attacks on the New York-based heart of the US 
financial industry before they were stopped, but not before the FBI 
discovered that they attempted to hack and hijack the controls of 
the Rye Brook dam sluice gate in Westchester County. Local 
authorities believe that the hacking may have been a test run for 
attacking the far larger Bowman dam on Crooked River, Oregon. 
Had either dam been commanded to release its water, there would 
have been an environmental disaster on an enormous scale. 


THE CYBER CORSAIRS 


The power of real hacking capability shows the potential of a group, 
even one with rudimentary capability, to learn lessons and grow. 
Despite the fact that none of the ISIS hackers or their malware have 
risen to the level of being an Advanced Persistent Threat (APT), that 
day will come. ISIS and its E-Mujahideen may be amateur, but with 
just a bit of technical skill and the ambition to become hacker 
famous, they could become as notorious as the 9/11 hijackers. 

At this point, however, ISIS and other jihadist group are capable 
of causing a nuisance in comparison to the capability of real 
advanced threat groups like the FSB and IRGC. They aren’t yet 
capable of hacking industrial infrastructure or doing more than the 
distribution of propaganda and the dissemination of their dark 
media. 

Yet new hacker technology emerges every day. In August 2016, 
an NSA subcontractor, Equation Group, was hacked by suspected 
Russian intelligence hackers who stole terrifying hacker tool kits 


with names like Epicbanana, Egregiousblunder, and Buzzdirection. 
These tools could bore through security Firewalls, seize controls of 
computers, and watch and capture the keystrokes of security 
officers. They were stolen from the most elite hackers in the world 
by a group calling itself “Shadow Brokers.” It was selling these tools 
for $500 million in bitcoins. Should any tool kits like these fall into 
the hands of one or a collective of ISIS supporters, then the attacks 
on the West would be devastating. 

By devolving back into an underground and web-based terror 
organization, ISIS will be communicating more directly with 
ambitious young people who have deep cyber knowledge and may 
acquire exceptional hacking skills. 

If there is anything that has been learned about ISIS, it is that it is 
committed to waging asymmetric warfare, using electronic and 
propaganda judo to confound their opponents. The future E- 
Jihadists will do the same. They will form very small groups and 
adopt the tactics of the Arab pirates of old—a legion of Cyber 
Corsairs. Like the original corsairs, their platforms, computers, and 
mobile phones will be used for everyday tasks till they sight a target 
of opportunity. They will then band together swiftly and harness 
the fastest, simplest technology to hack with whatever tools they 
can muster until the older, slower objective is raided, looted, and 
left a hulk. It worked for centuries off the coast of Arabia, and it can 
work again in the cyber coast between the Deep Web and the 
Surface Web. The Internet is a sea of Islands and makes every 
wired-in device a treasure ship to be raided. We won’t know if they 
have this capability until the start to strike. 

A nascent group of Cyber Corsairs may already be working with a 
collective. These ISIS hackers, the fanboys and young wannabees, 
are derided as “script kiddies” because they cannot write really 
malicious code but use programs from other hackers. They may 
seem harmless today, but if they get their hands on tools such as 
those stolen from NSA, they will lack only direction and leadership. 
The global cyber security world must prepare for higher-quality 
weaponized tool kits in the hands of the seemingly least capable 
hacker who has big dreams. Imagineering is the single greatest 
vulnerability we have in anti-terrorism and cyber security. If Russia 
or China decided to empower some of their young corsairs with real 
tools, or if they themselves somehow acquire the capability, they 
could move from being minor players into a renowned and feared 


global hacker force that could shut down power plants, disrupt 
airplane flight controls and destroy oilfield industries. 

The strength of ISIS is it has have created a structure of 
communications, coordination that operates out of the view of the 
news media and most IT researchers operating on the Surface Web. 
ISIS cyber capability has always been sounder in the development 
of its Deep Web IT infrastructure, because it created a secure 
network of contact points that has allowed it to communicate and 
disseminate propaganda and establish long-term covert 
communications pathways between their operatives world-wide. 
This infrastructure may be the salvation of what remains of the 
protostate itself. 

Make no mistake: ISIS is presently on a path to its ultimate 
physical destruction. It will lose its capital Raqqa and its suicidal 
combat forces deployed in several nations besides Syria and Iraq. 
They will all be destroyed. The caliphate’s physical treasury will be 
looted, and its global financial capital will be stolen by its members 
or seized by coalition forces. ISIS will be left bereft of its earthly 
fortune—except for one cash cow that has heretofore remained 
undetected. Advertising fraud. 


THE ISIS ADWARE FRAUD NETWORK 


In 2014, an American cyber defense firm discovered, while 
conducting banking fraud tracking, that for the last three years ISIS 
has been collecting as much as $100 million through the 
establishment of a constellation of advertising fraud networks and 
websites. This network was established by ISIS’s supporters in the 
Gulf States operating within legal web distribution companies in 
Dubai, Saudi Arabia, and other Arab states. These, along with other 
ISIS Deep Web operations, were established by former Jordanian, 
Palestinian, and Russian criminal cyber operatives who set up the 
same advertising fraud networks across Asia and the Middle East. 
Adfraud works by conducting typo-squatting, also called Water 
Holes—false websites with a only a spelling mistake to distinguish 
them from the sites they are impersonating. It looks and acts like 
the original. For example, Quran.com is legitimate but slips up on 
the spelling—Qiran.com—and it leads you to an identical site that 
is actually owned by the typo-squatter hacker. This false site can 


collect credit card information, be a portal for malware, or is just 
filled with links and pop-up boxes that pay the typo-squatter every 
time you click on a link or close a pop-up box. Typo-squatting relies 
on a person to make a mistake when putting in a legitimate URL 
that takes them to a fraudulent website that is populated with 
legitimate web advertising links. Once an innocent victim goes to 
this website via any of the links that they click (or that is clicked for 
them), the visited site will legally pay a small amount of money to 
the typo-squatter—from as low as a penny to as high as $25 per 
click, depending on the site visited. All of the money goes into the 
bank accounts of ISIS. 

The ISIS AdFraud servers also harbor a constellation of self- 
regenerating advertisement bots that spray out new links onto other 
legitimate websites. As they are clicked, or closed, they generate 
revenue. Closing the bots requires one to visit the links, so even 
experienced cyber attackers or researchers with good intentions 
manage to directly contribute to the ISIS coffers. 

The websites and links of ISIS are arrayed in such a way that 
legitimate searchers of news and information will misdirect 
researchers to ISIS Adfraud sites—where they will find links to the 
legitimate news sites. Again, once any of those links are clicked or 
closed, ISIS gets paid. However, also embedded within the sites may 
be links to ISIS terrorism video media, propaganda, and secret 
pathways to web forms and secure communication portals. In fact, 
many researchers, intelligence officials, members of the news 
media, and just the curious who go to many of the web storage sites 
that have ISIS media embedded are in fact paying the organization 
for every click they make within these sites. The more people track 
these Surface Web sites, the more ISIS gets paid. The visitor is 
materially contributing to the financial future of a terrorist group. 

When the caliphate falls the question will be what form the 
disparate followers of this group will take. Anyone who survives 
can probably leave the battlefronts of Libya, Syria, Iraq, Yemen, and 
Afghanistan in an attempt to return home. For a while, they may be 
out of touch with their Jihadi brothers at home. Those who 
successfully return to their homeland, particularly Europe and the 
United States, will have to face a level of scrutiny from national and 
international intelligence agencies never seen before. But this 
doesn’t matter if they can still inspire, coordinate, and finance 
operations though the Deep Web. ISIS will live on, and the role of 


the cyber Jihadis will become the face of the average member. 

That said, the ISIS Deep Web communications structure will have 
to survive, at least initially, on cash rolling in from Internet 
advertising fraud networks. 


THE FUTURE OF ISIS AFTER ISIS 


The future of ISIS is that it will reform in the shape of a Ghost 
Caliphate. 

On its face, the destruction of ISIS will be a historic achievement, 
but the by-product will be a less centralized terror group that will 
rely much more on inspiring terror attacks rather than planning 
them and deploying cells. For the next decade or more, ISIS- 
inspired terrorists such as the husband and wife suicide team in San 
Bernardino, the truck driving murderer in Nice, and the mass 
murder at the gay night club in Orlando, Florida, will become the 
norm. These types of attackers, who dream up a plan and then 
execute it without saying a word or leaving a deep digital footprint, 
are extremely difficult to detect. Once an inspired attacker finds the 
right target and acquires a weapon, be it a bomb or a tractor trailer, 
they can kill with impunity and claim ISIS loyalty after the fact. 
This is future model of ISIS’s global disruption campaign. 
Conversely, ISIS-directed attacks from a central Cyber Caliphate 
will decrease or disappear as the bases of operations are physically 
destroyed; the Ghost Caliphate will take its place and remain 
devoted to terrorism—by proxy. 

The Ghost Caliphate will be broader, more covert, surreptitious, 
and much harder to detect. ISIS will essentially devolve back into 
the original model al-Qaeda used between 1988 and present day—it 
will become a covert terror organization that is 100 percent 
underground—leaving evidence of its activities only after the fact. 

To establish the Ghost Caliphate, some of the surviving leadership 
of ISIS must find a safe haven to have any chance of reconstituting 
the terror network. Their best chance is to find a small remote area 
in Yemen, the central Sahara, or a hidden corner of Somalia. There, 
they can attempt to reestablish communications pathways using 
satellite Internet or regional mobile phone technology and basic 
operational security in an effort to connect with other surviving 
members. Only then can they reestablish a central command that 


will give the current cyber warriors the support and direction they 
need. Without some form of leadership, the Ghost Caliphate will be 
equivalent to trolls on comments sections of digital editions of 
newspapers. 

The Ghost Caliphate will not direct individuals on precisely what 
to do but will become a completely inspirational organization that 
will call upon its attackers to join, secretly swear allegiance, and 
attack wherever, whenever, however. The future battle strategy of 
the failed Islamic state will essentially abandon all attempts to seize 
land like they did in Iraq, Syria, Libya, and Egypt. 

With this strategy, there will also be an increase in attacks 
claimed by or attributed to ISIS even when there is no evidence that 
ISIS was ever in communication with or inspired those who carried 
out the attack. That would be expected as they break up and 
dissolve from a solid into a gaseous state of ideology. 

The ghost hackers will use advanced tools rather than 
Kalashnikovs, propaganda in place of bombs, and, like the 9/11 
hijackers, they will someday be poised to conduct an asymmetric 
war at the place, time, and with the methodology of their choosing. 


Appendix A 


ISIS Magazine Issues 


ISIS MAGAZINE RELEASES 


Al-Hayat-Islamic State News 
Edition #1—May 31, 2014 
Edition #2—June 5, 2014 
Edition #3—June 10, 2014 


Al-Hayat-Islamic State Report 

Edition #1—June 3, 2014: Propagating the Correct Manhaj 
Edition #2—June 7, 2014: Giving Zakah 

Edition #3—June 14, 2014 

Edition #4—June 21, 2014 


Al-Hayat-Dabiq 

Edition #1—July 5, 2014: The Return of the Khilafah 

Edition #2—July 27, 2014: The Flood 

Edition #3—September 10, 2014: A Call to Hijrah 

Edition #4—October 11, 2014: The Failed Crusade 

Edition #5—November 21, 2014: Remaining and Expanding 
Edition #6—December 29, 2014: Al-Qaeda of Waziristan: A 
Testimony from Within 

Edition #7—February 12, 2015: From Hypocrisy to Apostasy: The 
Extinction of the Grayzone 

Edition #8—March 30, 2015: Shariah Alone Will Rule Africa 
Edition #9—May 21, 2015: They Plot and Allah Plots 


Edition #10—July 13, 2015: The Law of Allah or the Laws of Men 
Edition #11—September 9, 2016: From the Battles of Al-Ahzab to 
the War of Coalitions 

Edition #12—November 18, 2016: Just Terror 

Edition #13—January 19, 2016: The Rafidah 

Edition #14—April 13, 2016: The Murtadd Brotherhood 

Edition #15—July 31, 2016: Break The Cross 


Istok—ISIS’s Russian-language magazine 
Edition #1—May 25, 2015 

Edition #2—August 1, 2015 

Edition #3—November 30, 2015 

Edition #4—May 1, 2016 


Dar al-Islam—ISIS’s French-language magazine 
Edition #1—December 22, 2014 

Edition #2—February 11, 2015 

Edition #3—March 31, 2015 

Edition #4—June 1, 2015 

Edition #5—July 21, 2015 

Edition #6—September 27, 2015 

Edition #7—November 30, 2015 

Edition #8—February 6, 2016 

Edition #9—April 26, 2016 


Konstantiniyye—ISIS’s Turkish-language magazine 
Edition #1—May 26, 2015 

Edition #2—August 1, 2015 

Edition #3—November 30, 2016 

Edition #4—May 1, 2016 


An-Naba 

An-Naba was a weekly newspaper released in PDF form online and 
printed for those living under the authority of the Islamic State. 
Printed entirely in Arabic, the target audience was very local. The 
publications are released often midweek and publication segments 
are often edited up to the last minute including examples where the 
publication mentioned news from only a day before release. 


Rumiyah 
Edition #1—August 31, 2016 


A new magazine from ISIS was released with the headline, “The 
Death of Abu Muhamad Al-Adnani.” 


Appendix B 


Al-Hayat Video Database 


AL-HAYAT VIDEOS 


Video #1. June 9, 2014 There is no life without al-jihad: British 
fighters describe why they left to go fight in Syria in this first video 
from al-Hayat. 


Video #2. June 29, 2014 End of Sykes-Picot: Chilean foreign 
fighter Bastian Alexis Vasquez appeared in “End of Sykes-Picot.” 


Video #3. July 12, 2014 al-Ghurabaa: The Chosen Few of Different 
Lands—Abu Muslim from Canada: Canadian “Abu Muslim,” a.k.a. 
Andrea Poulin, discusses his hijra and the glorious deaths of ISI 
fighters in Syria. 


Video #4. July 16, 2014 Those Who Were Truthful with Allah. 


Video #5. July 22, 2014 Join the Ranks: Abu Muhammad al- 
Indonesi pushes Muslims to act on hijra. 


Video #6. August 2, 2014 Eid Greetings: Eid al-Fitr celebration 
with foreign fighters who have traveled to the Islamic State. 


Video #7. September 16, 2014 Flames of War trailer. 


Video #8. October 16, 2014 We Are Also Waiting: Abu Abdullah 
from Britain, Abdul Wadoud from France, Abu Dauoud from 
Germany. 


Video #9. November 2, 2014: A Message from Brother Abu 
Muhammad ar-Rousi. 


Video #10. November 19, 2014: What Are You Waiting For: 
French-language video that features Abu Osama al-Faranci and Abu 
Maryam al-Faranci, who demanded, “why haven’t you made hijra, 
aren’t you embarrassed yet? If you can’t make hijra, kill kufar 
where you find them.” What Are You Waiting For” also includes Abu 
Salman al-Faranci. 


Video #11. November 21, 2014 Race Towards The Good: Kazakh- 
language film with Russian subtitles. Abdalluh, a child soldier, was 
asked what he wanted to do when he grows up: “I will be the one 
who slaughters you, O kuffar.” 


Video #12. November 28, 2014 A Visit to al-Mosul: An ISIS view 
on how Mosul was captured in 2014 and how the people enjoy 
Islamic justice under ISIS. 


Video #13. January 4, 2015 From Inside Mosul: John Cantilie, a 
hostage, is forced to tour the city in the role of a supposedly ISIS- 
friendly “journalist.” 


Video #14. January 6, 2015 A Message from Brother Abdullah al- 
Moldowvi. 


Video #15. January 13, 2015 Uncovering an Enemy Within: A 
terrorist hostage, Mamayev Jambulat Yesenjanovich, from Jambul, 
Kazakhstan, is accused of being a spy. He confesses on video to 
being a Russian intelligence (FSB) agent and sticking a USB stick 
into the laptop of an ISIS operative in Turkey. A second hostage, 
Ashimov Sergey Nikolayavich, was also accused of being an FSB 
agent. Video ends with a young Kazakh boy, previously identified in 
video #9 as Abdalluh, shooting both captives through the head. 


Video #16. February 9, 2015 From Inside Halab (Aleppo): John 
Cantilie, a hostage, is again forced to tour Aleppo in the role of a 
supposedly ISIS-friendly “journalist.” 


Video #17. February 15, 2015 A Message Signed With Blood to the 
Nation of the Cross: A long-format hostage video where twenty-one 


Egyptian Coptic Christians are executed by beheading on the Libya 
seafront (coast of Wilayat Tarabulus). 


Video #18. March 7, 2015 Story from the Land of Life: Abu Suhayb 
al-Faransi. 


Video #19. March 23, 2015 A Message to the People of Kurdistan: 
Short videos featuring deceased fighters (including Kattib, Abu 
Ishaq, Osama Bin Ladin, Abu Hammam) and ending with execution. 


Video #20. April 21, 2015 Stories from the Land of the Living: 
Features Australian Neil Prakash, a.k.a. Abu Khaled al-Cambodi. 


Video #21. June 4, 2015 Honor is in Jihad: Features a propaganda 
message to the people of the Balkans. 


Video #22. August 29, 2015 The Rise of al-Khilafa and Return of 
the Gold Dinar. 


Video #23. October 11, 2015 The Dark Rise of Banknotes and the 
Turn of the Gold Dinar. 


Video #24. November 21, 2015 Turkey and the Fire of Nationalism. 


Video #25. November 24, 2015 No Respite: Released in English, 
French, German, Russian, and Turkish. 


Video #26. January 24, 2016 Et Tuez-Les où que vous les 
rencontriez (French: Kill Them Where You Find Them): Features 
training segments with the terrorists responsible for the Paris 
attacks in November 2015. 


Video #27. March 6, 2016 Al Qauqaz: Aliment and Cure (Russian 
with Arabic Subtitles). 


Video #28. May 30, 2016 The Religion of Kufr is One. 
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